Autism Stereotyped Behavior Detection (Spinning / Hand-Flapping) | 自闭症儿童刻板行为识别（转圈/摆手）

• Outcome: Review
• Latest audit: Oct 15, 2026 · 8:37 AM UTC
• Version: 1.0.13

Overview

The skill matches its advertised cloud video-analysis purpose, but it handles sensitive child-behavior media with silent account creation, token persistence, cloud history access, and limited user control.

Install only if you are comfortable sending children's behavior videos or URLs to the configured cloud service and having reports tied to a silently managed account. Obtain guardian consent first, clarify the provider's retention/deletion and access-control practices, and avoid using the history-list feature unless cloud-stored prior reports are expected.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises computer-vision analysis for children's videos, but the underlying behavior appears to include remote account/login handling, local token/user storage, workspace discovery, and local directory manipulation without the promised CV functions. This is dangerous because it combines sensitive pediatric data with undisclosed authentication and persistence mechanisms, increasing privacy and compromise risk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-autism-stereotyped-behavior-detect-analysis"
description: "Using a fixed camera in rehabilitation centers or homes, the system analyzes children's behavior videos with pose estimation and temporal action detection to recognize repetitive stereotyped behaviors, including spinning (body rotation ≥ 360°), hand flapping (non-functional repetitive arm movement), body rocking (rhythmic forward-backward or side-to-side trunk motion), etc. | 通过康复机构或家庭固定摄像头，分析儿童行为视频，利用姿态估计和时序动作检测技术识别重复性刻板动作，包括转圈（身体旋转360°以上）、摆手（手�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This shared utility file performs identity resolution, credential persistence, token recovery, automatic account provisioning, and arbitrary remote API requests, which is far outside the declared purpose of analyzing child behavior videos. In the skill context, this hidden backend/account behavior is more suspicious because users would reasonably expect local or narrowly scoped analysis functions, not generalized authenticated service access and account lifecycle management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code silently calls a remote /sys/phoneLogin endpoint with register=1 and user identifiers, meaning it can create or log into accounts without clear operator action. In a skill advertised for autism-related behavior detection, undisclosed account creation is especially dangerous because it transmits identity data and binds users to external services unrelated to the stated function.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares broad capabilities implied by its workflow and examples (shell execution, network access, file read/write, environment use) but does not constrain them with an explicit tool/permission scope. In an agent environment, this increases the blast radius if the skill is invoked unexpectedly or if its instructions are abused, because the runtime may permit more access than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The default trigger is broad enough to activate on generic child-behavior video requests, which can cause unintended handling of sensitive media and accidental execution of networked/reporting workflows. Because this skill processes minors' highly sensitive behavioral footage, mistaken activation materially increases privacy risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The historical-report triggers use broad phrases that may overlap with ordinary requests, increasing the chance that the skill automatically queries cloud records without clear user intent. In this context, that could expose sensitive past reports about minors or retrieve more data than the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that uploaded images/videos are automatically saved locally, but it does not present a clear user-facing warning, retention policy, or safeguards for this extremely sensitive category of data. Since the content involves identifiable videos of children and health-adjacent behavior information, silent local persistence is a serious privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The returned user-facing string is hardcoded in Chinese, which imposes a specific language on users. The file provides no indication of user opt-in, locale selection, or a documented reason for restricting output to Chinese.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script exposes a --list mode that retrieves prior analysis records tied to an internal open_id, which is outside the stated purpose of analyzing a supplied child-behavior video. In a sensitive medical/child-behavior context, enumerating or retrieving prior analyses by identity can disclose highly sensitive history and metadata if access control is weak or implicit identity resolution is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code silently initializes an internal user identity via OpenIdUtil.resolve_current_open_id(...) while suppressing the related CLI parameter from help output. Hidden identity handling in a tool processing sensitive child behavioral videos creates a risk of unintended account binding, unauthorized access to another user's records, and reduced user awareness of data association.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The tool accepts local files or remote URLs for analysis of highly sensitive child-behavior footage, but it provides no warning that content may be transmitted to a backend service or stored. In this context, users may unknowingly expose protected health-like or child data, making the omission a meaningful privacy and safety issue.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code reads an arbitrary local file path, loads the entire file into memory, and uploads its contents to a remote analysis API, but it provides no user-facing consent, privacy notice, or contextual warning in this path. In this skill's context, the uploaded content is children's behavior video from homes or rehabilitation centers, making the privacy risk materially higher because highly sensitive minors' health/behavior data may be transmitted off-device without explicit disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The analysis function accepts local file paths or remote URLs and forwards them to backend analysis logic without clear disclosure that video content may be transmitted over the network. Because the skill processes videos of children in homes or rehabilitation settings, undisclosed transmission materially increases privacy and compliance risk, and remote URL handling can also cause unexpected fetching of third-party content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The hidden --api-key parameter suppresses visibility in help output, encouraging opaque credential handling and making it easier for users or wrappers to pass secrets unsafely on the command line. Command-line secrets may be exposed via shell history, process listings, or logs, which is especially concerning for services handling sensitive child video analysis.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2