Child Hazardous Behavior Recognition Tool | 儿童危险行为识别分析工具

• Outcome: Review
• Latest audit: Oct 17, 2026 · 6:14 PM UTC
• Version: 1.0.17

Overview

This skill appears intended for child-safety video analysis, but it automatically sends sensitive media and identity-linked requests to external services while creating and reusing local user/token state.

Review before installing. Use this only if you are comfortable with child-monitoring images or videos being processed by the configured lifeemergence.com services, with local default identity and token data being created/reused in the workspace. Prefer a version that clearly documents consent, retention, deletion, account creation, token storage, and exact API endpoints before using it with real children or private household footage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation evidence suggests outbound authenticated API requests, filesystem writes, environment/workspace inspection, local identity persistence, and account creation flows under the label of child-safety recognition. In this context, that is especially dangerous because surveillance media involving children is highly sensitive, and undisclosed identity/account operations materially increase privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documented endpoints and scenario code describe pet health analysis rather than child dangerous behavior recognition, creating a clear scope and capability mismatch. In a safety-monitoring skill, this can misroute sensitive uploads, trigger the wrong backend workflow, or cause operators and integrators to trust outputs from an unrelated service, leading to failed detection and privacy exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file exposes broad generic CRUD and raw HTTP helper methods that allow callers to send requests to arbitrary URLs, which is far beyond the stated child-danger behavior recognition purpose. In a skill intended for safety monitoring, this unjustified network capability can be repurposed for data exfiltration, unauthorized backend actions, or hidden command-and-control style communication if any upstream input is attacker-controlled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The http_post/http_put/http_get/http_delete methods directly proxy arbitrary URLs to RequestUtil without any visible restriction, validation, or scope control. Because the skill context is child-safety recognition rather than a general integration framework, this creates unjustified general network access that could be abused to reach internal services, exfiltrate sensitive data, or perform unauthorized actions on remote systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file defines a generic user-account persistence layer, including user lookup and update routines, inside a skill whose declared purpose is child dangerous-behavior recognition. That capability mismatch is suspicious because it enables collection and maintenance of user identity data unrelated to the advertised vision/safety function, increasing the chance of covert data retention or account manipulation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The User model stores personal profile fields and authentication-like secrets such as token and open_token without any justification tied to child-dangerous-behavior detection. In the context of a child-safety monitoring skill, unnecessary storage of tokens and PII is especially sensitive because it expands the attack surface and could expose guardian or child-related account data if the local database is accessed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring and debug output claim the function invokes openclaw agent via subprocess, but the implementation does not do so and instead uses a placeholder dict, causing inconsistent behavior. This mismatch is dangerous because it can mislead reviewers and operators about what code is actually running, hide unfinished or disabled execution paths, and create conditions for insecure re-enablement later without proper review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The utility layer silently bootstraps accounts and performs remote user registration/login flows unrelated to the stated child-danger recognition purpose. In a safety-monitoring skill, hidden identity provisioning and backend enrollment materially expands the trust boundary and can transmit persistent identifiers and create remote accounts without clear user awareness or necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code performs outbound authentication and API requests while assembling and transmitting identity values and tokens in headers/body, yet there is no clear user disclosure in the skill. In a child-supervision context, hidden transmission of identifiers and authentication material is especially concerning because it may expose operator or environment-linked identities to external infrastructure unrelated to immediate safety alerts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation instructs use of shell, filesystem, network, environment, and write-capable behavior but does not declare any explicit tool scope or permission boundaries. This creates an over-privileged integration surface where an agent may invoke sensitive capabilities without transparent least-privilege constraints, increasing risk of unintended file access, command execution, or outbound data transfer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default trigger activates broadly whenever a user provides a monitoring video URL or file for child-danger recognition. Overly broad automatic activation can cause unintended processing of sensitive media, especially in a child-monitoring context where uploaded videos may contain private household or childcare footage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes cloud historical-report querying and report-link retrieval that go beyond immediate child-danger recognition. This increases data exposure because historical reports may contain sensitive surveillance-derived information, and the added retrieval functionality broadens the remote data-access surface beyond what users may expect from a detection skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says uploaded attachments or media files are automatically saved locally without user-facing warning about retention, access, or deletion. For child-safety videos, silent local storage is particularly sensitive because it can retain recordings of minors on disk beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The cloud history-query behavior requires direct API calls but does not provide a clear user-facing warning that remote data access and transmission will occur. This is dangerous because users may unknowingly trigger retrieval of sensitive historical child-monitoring reports from external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states the system may auto-create and reuse a local default user identity when no upstream identity is provided. Silent identity creation and reuse are risky because they can cause cross-session data mixing, unauthorized association of reports, and opaque persistence of user-linked records without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains natural-language strings for errors, status messages, help text, and reports entirely in Chinese, and it does not offer any option to select another language. That can violate language/locale policy because the skill effectively forces a specific language on all users without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2