ClawHub
Back to skill

Security audit

Autism Stereotyped Behavior Detection (Spinning / Hand-Flapping) | 自闭症儿童刻板行为识别（转圈/摆手）

Security checks across malware telemetry and agentic risk

Overview

The skill’s child-behavior video analysis purpose is coherent, but it automatically creates or reuses identities, uploads sensitive minors’ media, queries cloud history, and stores tokens with limited user control.

Install only if you are comfortable with a cloud service receiving children’s behavior videos or URLs, identity-linked request fields, and history-report queries. Use it with guardian consent, avoid shared machines unless the workspace data directory is protected, and treat generated reports as non-diagnostic support for qualified professionals.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
76% confidence
Finding
The list() method applies filters using getattr(self.__model__, key) where key comes from the caller. Even though SQLAlchemy prevents classic SQL injection here, unvalidated attribute selection can let callers query on unintended fields, trigger exceptions for bad keys, and bypass intended access restrictions by filtering on sensitive/internal columns.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
76% confidence
Finding
The count() method repeats the same caller-controlled getattr() pattern for filters. While this is not raw SQL injection, it can expose schema details through errors and allow unauthorized querying/counting over internal fields if higher layers pass user-controlled filter dictionaries.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill manifest advertises and instructs use of shell execution, local file handling, environment use, and network access, but does not declare permissions or clearly scope those capabilities. This creates a transparency and policy-enforcement gap: a host may allow the skill under the assumption of low privilege while the documented workflow actually requires sensitive capabilities, including access to children’s videos and cloud endpoints.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill goes beyond behavior-video analysis by automatically querying cloud history reports and silently associating a user identity, including fallback to a local default user. In a pediatric-health context, this expands the data surface from a single uploaded video to longitudinal sensitive records, increasing the risk of unauthorized access, cross-user data exposure, and privacy violations.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file exposes broad generic network helpers and CRUD-style wrappers (add, edit, delete, http_post, http_put, http_get, http_delete) that are not constrained to the skill's declared purpose of autism-related behavior video analysis. In an agent skill context, such unrestricted transport primitives expand the skill's capability surface and can be reused to contact arbitrary endpoints or perform unrelated operations, creating a meaningful risk of unauthorized data access, exfiltration, or remote state changes if other parts of the skill pass attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The add, edit, and delete methods provide unrestricted remote modification capability through simple pass-through POST calls, without any visible authorization checks, endpoint restrictions, or purpose limitation tied to rehabilitation analysis. In this skill context, that is suspicious because the manifest describes passive video behavior recognition, not generic mutation of remote resources; if misused, these methods could alter external systems or sensitive records beyond the user-expected scope.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This configuration code reads user-identifying environment variables such as sender open IDs and usernames even though the declared skill purpose is autism stereotyped-behavior video analysis. In a shared skill environment, that creates unnecessary collection and propagation of personal identifiers, increasing privacy risk and enabling cross-context data leakage if downstream code logs, stores, or transmits these values.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This file includes generic user-account persistence, identity fields, and token storage logic that does not align with the declared purpose of analyzing children's stereotyped behavior from video. In a sensitive pediatric/rehabilitation context, collecting and retaining usernames, real names, emails, birthdays, and tokens expands the attack surface and privacy risk without a clear necessity shown here.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The User model stores token and open_token values directly in a local SQLite database, but the skill description is about rehabilitation video behavior analysis rather than authentication. Storing authentication-style secrets in plaintext or application-accessible form is dangerous because compromise of the local DB could expose reusable credentials or session tokens, especially in home or care-center deployments with weaker endpoint security.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This utility code performs remote account provisioning, token retrieval, and persistence that is unrelated to the declared child-behavior video analysis purpose. That creates undisclosed identity establishment and network-side state changes, expanding the trust boundary and enabling silent user/account creation plus transmission of identifiers and auth tokens to external services.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code reads identity material from workspace files and, if absent, creates a persistent local default identity in a database for later reuse. For a skill advertised as behavior-video analysis, this hidden identity bootstrap is unnecessary and risky because it silently binds local workspace state to remote-request identity without user awareness.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger is broad enough to auto-activate the skill for generic child-behavior video analysis requests. In this context, over-triggering is dangerous because it can route sensitive minors’ media into an autism-related analysis pipeline without sufficiently specific user intent or informed consent.

Vague Triggers

High
Confidence
96% confidence
Finding
The historical report trigger phrases are broad and can auto-invoke access to highly sensitive prior reports based on common language such as viewing reports or records. Because the data concerns children and potentially health-related behavioral monitoring, accidental activation could disclose longitudinal private information without clear authorization or intent verification.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments or video/image files are automatically saved locally, but this is not surfaced as a clear user-facing warning at the point of use. Automatic local retention of minors’ behavioral videos creates privacy and data-handling risks, especially on shared or unmanaged systems.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill requires direct cloud API calls for history-report queries but does not clearly warn users that sensitive report-query data and identity-linked context will be transmitted off the local system. Given that the subject matter involves minors’ health-adjacent behavioral data, undisclosed transmission materially increases privacy, compliance, and unauthorized disclosure risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code reads arbitrary local video files into memory and transmits them to a backend analysis service, but this file contains no user-facing consent, disclosure, or privacy guardrails before upload. In this skill’s context, the videos involve children in homes or rehabilitation centers and may contain highly sensitive behavioral and health-related data, making silent transfer materially risky even if the functionality is intended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The HTTP wrapper automatically attaches user identifiers, tenant information, API keys, and authorization tokens to outbound requests, yet this file provides no explicit disclosure or consent flow. In the context of a child-behavior analysis skill, silent transmission of identity/authentication data is more concerning because it is outside the stated purpose and may expose operator or workspace-linked identities to a remote platform.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt and later uses it to resolve the current open-id for remote operations, without any visible disclosure in this module. This is dangerous because local workspace secrets or identity values can be repurposed for external requests implicitly, surprising users and increasing the risk of cross-context identity leakage.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
The requests.post() call sends openId, mobile, and source data to a remote login/provisioning endpoint, causing external transmission of identity-related information. While HTTPS may reduce interception risk, the core issue is undisclosed network exfiltration of identifiers unrelated to the stated local video-analysis functionality.

Hidden Instructions

High
Category
Prompt Injection
Content
| 📁 格式支持 | 输入要求：支持 mp4/avi/mov 视频，最大 10MB；**关键**：必须能看到儿童全身，帧率 ≥ 10 FPS |
| 🔎 使用提醒 | 部分日常动作（鼓掌、跳舞、追逐游戏等）可能被误识别为刻板行为，建议康复师/家长进行抽样复核 |
| 🔎 使用提醒 | 多儿童在同一视野内、家庭成员同时出现等情形可能影响识别准确性 |
| 🧑‍⚖️ 结果性质 | 本工具**不提供自闭症诊断**，也**不替代** ADOS-2 / ADI-R / CARS 等专业评估；任何康复方案应在认证的康复治疗师指导下进行 |
| 🔏 隐私合规 | 隐私合规：自闭症儿童行为视频涉及未成年人高度敏感隐私，使用前需取得监护人明确知情同意，妥善加密保管；建议优先采用人体骨架/轮廓模式 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence
74% confidence
Finding
The hidden-instructions indicator suggests the manifest may contain concealed or non-obvious directive content affecting agent behavior. In a skill that handles shell commands, file operations, and cloud access, hidden control text can be used to steer execution paths or suppress safeguards in ways a reviewer or user may not notice.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-autism-stereotyped-behavior-detect-analysis"
description: "Using a fixed camera in rehabilitation centers or homes, the system analyzes children's behavior videos with pose estimation and temporal action detection to recognize repetitive stereotyped behaviors, including spinning (body rotation ≥ 360°), hand flapping (non-functional repetitive arm movement), body rocking (rhythmic forward-backward or side-to-side trunk motion), etc. | 通过康复机构或家庭固定摄像头，分析儿童行为视频，利用姿态估计和时序动作检测技术识别重复性刻板动作，包括转圈（身体旋转360°以上）、摆手（手臂非功能性重复摆动）、摇晃（躯干前后或左右有节律摆动）等。该技能可辅助康复师和家长客观记录行为变化，评估干预效果。"
version: "1.0.10"
license: "MIT-0"
---
Confidence
81% confidence
Finding
The metadata poisoning signature is credible here because the skill manifest combines rich behavioral instructions, auto-trigger rules, identity handling, shell invocation, and hidden-instruction indicators. Poisoned or overloaded metadata can manipulate downstream agents into taking actions—such as cloud queries or file handling—based on manifest text rather than explicit user authorization.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2