ClawHub
Back to skill

Security audit

Child Bedtime Soothing (Fear of Dark / Post-Nightmare) | 儿童睡前情绪安抚（怕黑/噩梦后）

Security checks across malware telemetry and agentic risk

Overview

This skill handles very sensitive child bedroom media through cloud APIs and silent account setup, with some capabilities and data flows under-scoped or mismatched with its description.

Review this carefully before installing. It is not just a local bedtime-soothing helper: it can send child bedroom media or media URLs to cloud analysis, query cloud history, silently create or reuse an identity, and store service tokens locally. Only use it if the publisher can explain the cloud endpoints, retention policy, parental consent model, token storage, and why the default config points to dev/private HTTP services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
This code applies filters using getattr(self.__model__, key) where key comes from the caller-controlled filters dictionary. While SQLAlchemy prevents classic SQL injection here, unvalidated attribute selection can expose unintended model fields, trigger errors, or enable unauthorized querying over sensitive columns if higher layers pass user input through directly.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
The count() method repeats the same caller-influenced dynamic attribute lookup pattern as list(), allowing untrusted filter keys to control which model attributes are queried. In practice this can enable unauthorized metadata probing, error-based information disclosure, or misuse of internal fields if external input reaches this DAO unchecked.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The manifest exposes capabilities consistent with environment access, file read/write, network access, and shell execution without declaring permissions or presenting clear user-facing consent boundaries. In a child-bedroom monitoring skill handling highly sensitive audio/video and historical reports, this mismatch increases the risk of covert data collection, local persistence, and remote exfiltration beyond what users reasonably expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose says the skill performs direct soothing and bedtime distress analysis, but the implementation behavior includes backend account/token management, local user/open-id persistence, and cloud report retrieval while not actually implementing the promised local soothing controls. This kind of description-behavior mismatch is dangerous because it can conceal identity linkage, data retention, and remote processing of children's bedroom media that users did not meaningfully authorize.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest claims automatic night-light and audio soothing actions, but the described implementation only calls an analysis/reporting script and cloud history queries. This misrepresentation can cause operators and users to trust the system with childcare/safety expectations it does not fulfill, including assuming real-world intervention occurs when a child is distressed or out of bed.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary http/https video URLs even though the described use case is a fixed bedroom camera/microphone workflow. Allowing unrestricted remote URLs expands the trust boundary, can enable analysis of third-party or attacker-controlled content, and may cause privacy, consent, or backend request-safety issues if the downstream analysis service fetches the URL server-side.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This file exposes generic HTTP methods (GET/POST/PUT/DELETE) that can send requests to arbitrary URLs, which is broader than the bedtime-soothing skill's declared purpose. In a skill that handles highly sensitive children's bedroom audio/video context, unnecessary network-capable wrappers expand the attack surface and could be reused by other code to exfiltrate data or perform unintended remote actions.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The add/edit/delete wrappers provide broad remote state-changing capability without any visible linkage to narrowly scoped bedtime-soothing functions. Even if intended as shared utility code, these methods enable arbitrary mutation operations against remote services and are risky in a privacy-sensitive child-monitoring skill because they can facilitate unauthorized data changes or supporting infrastructure abuse.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs remote account bootstrap, login, token retrieval, persistence, and authenticated API setup even though the declared skill is only for bedroom audio/video soothing analysis. This creates undisclosed identity and network behavior unrelated to the skill purpose, expanding the attack surface and enabling silent backend linkage of a child-focused monitoring deployment to remote services.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code derives identity from workspace state, reads local identity material, and creates persistent default user identities when none are supplied. For a child-bedroom monitoring skill, this is unjustified hidden identity management that can silently bind local workspace data and future network activity to a persistent account without meaningful user awareness.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The default trigger is broad enough to auto-invoke the skill for general child-bedroom night audio/video analysis requests, which risks processing extremely sensitive recordings without sufficiently specific user intent. In this context, overbroad triggering is especially dangerous because the data concerns a child's private bedroom environment and may be forwarded to backend services automatically.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The keyword-based history-report trigger can automatically invoke cloud history retrieval based on broad phrases, increasing the risk of exposing prior child monitoring records without clear authorization or context. Because these records concern a minor's bedroom monitoring history, accidental or unauthorized retrieval has elevated privacy consequences.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill centers on continuous monitoring of a child's bedroom via camera, microphone, and cloud-linked report history, yet the description lacks a prominent privacy warning and consent model. This omission is dangerous because users may not understand that highly sensitive child audio/video and behavioral data may be stored, transmitted, and linked to persistent identities.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill resolves an internal user identity via OpenIdUtil.resolve_current_open_id while suppressing the related CLI argument from help output, which reduces user awareness and transparency. In a child-bedroom audio/video context, hidden identity association increases privacy risk because sensitive monitoring results may be linked to a user account or historical records without clear disclosure or explicit consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill uploads local video files or submits remote video URLs for external analysis without any visible user-facing notice, consent gate, or data-handling disclosure in code. Because this skill processes children's bedroom audio/video, the privacy sensitivity is especially high; silent transmission of such data can violate user expectations, consent requirements, and child privacy safeguards.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends highly sensitive bedroom video/audio for analysis without any user-facing notice, consent prompt, or clear disclosure that data may leave the device. In the context of a child's bedroom, this materially increases privacy and compliance risk because intimate recordings of a minor may be transmitted or stored unexpectedly.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The function reads a workspace file containing identity-related data (smyx-api-key.txt) and uses it as an internal identity source without any user-facing disclosure or consent flow. In a sensitive context involving children's bedroom monitoring, silent harvesting of workspace identity data is especially problematic because users would reasonably expect narrowly scoped local operation.

Missing User Warnings

High
Confidence
99% confidence
Finding
The helper automatically sends identity data to a remote phoneLogin endpoint with silent registration enabled, including openId/mobile/source fields, without any user-facing warning. This is dangerous because it can silently create or log into accounts and exfiltrate identity-related information from an environment associated with a child-monitoring skill.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The general HTTP helper attaches authentication headers and request data to outbound requests with no normal-mode disclosure, while also automatically enriching payloads with tenant, platform, skill hub, and username values. This makes remote data sharing implicit and difficult to audit, which is particularly concerning for a skill operating in a child's bedroom where users expect strong privacy boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
This line performs external transmission of identity-related data to a remote service as part of silent login/registration. External transmission is materially more dangerous in this skill context because the manifest describes local child-soothing behavior, not remote identity enrollment or backend account creation.

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | **4 级安抚策略递进**（mild → moderate → strong → out_of_bed/Level 4），3 分钟未平复自动升级 |
| 🔎 使用提醒 | 单晚动作上限：mild × 5 / moderate × 3 / strong × 2 / Level 4 不设上限（安全优先） |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **禁止**对儿童做"睡眠障碍 / 夜惊症 / 焦虑症"等医学诊断 |
| 🔎 使用提醒 | **禁止**长期存储儿童夜间视频（≤ 7 天，仅入库不安事件片段） |
| 🔎 使用提醒 | **禁止**用于商业广告/AI 训练；禁第三方共享 |
| 🔎 使用提醒 | **禁止**冷白光（≥ 4000K）或亮度 > 30 lux 的小夜灯（打断褪黑素） |
Confidence
78% confidence
Finding
The hidden-instructions indicator suggests the document may contain non-obvious control text or formatting intended to influence tool behavior or review outcomes. In a high-sensitivity skill involving child monitoring and cloud access, hidden content is risky because it can obscure constraints, triggers, or unsafe behavior from users and auditors.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-child-bedtime-soothing-analysis"
description: "Through a fixed camera (with infrared night vision) and microphone in the child's bedroom, the system analyzes pre-sleep and night-time video and audio to detect pre-sleep crying (continuous crying, calling 'Mama'), fear-of-the-dark expressions (curling up, looking around), and nightmare awakenings (sudden sitting up, trembling, screaming). | 通过儿童卧室的固定摄像头（红外夜视）及麦克风，分析儿童睡前及夜间视频，检测睡前哭闹（持续性哭声、呼喊'妈妈'）、怕黑表现（身体蜷缩、四处张望）、噩梦惊醒（突然坐起、颤抖、尖叫）等行为。当检测到上述情绪不安时，自动触发安抚动作：开启小夜灯（柔光）、播放预先录制的妈妈讲故事音频或轻柔摇篮曲。"
version: "1.0.11"
license: "MIT-0"
---
Confidence
84% confidence
Finding
The manifest shows indicators associated with metadata or tool-poisoning, including suspicious description formatting and hidden-character artifacts. Such poisoning is dangerous because it can manipulate agent behavior, distort how tools are selected or interpreted, and conceal risky operations behind apparently benign childcare functionality.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2