ClawHub
Back to skill

Security audit

Child Hazardous Behavior Recognition Tool | 儿童危险行为识别分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches child-safety video analysis, but it silently creates or reuses account identity, stores tokens locally, and queries cloud history for sensitive child-monitoring reports.

Review this before installing in any environment with real child, home, school, or nursery footage. It can upload media or URLs to a backend, retrieve cloud report history, create or reuse an internal identity, and store service tokens in a local workspace database. Install only if you trust the publisher/backend and accept those data flows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
77% confidence
Finding
This code uses unvalidated filter keys from the caller to dynamically access model attributes. While SQLAlchemy prevents classic SQL injection here, an attacker or untrusted caller can trigger unauthorized querying over sensitive columns, bypass intended field restrictions, or cause crashes via invalid attributes, which becomes more concerning because this module also stores tokens and identity data unrelated to the child-safety purpose.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
As with list(), dynamic attribute selection in count() lets callers probe arbitrary model fields and enumerate records based on sensitive attributes. Even without SQL injection, this can leak metadata about user accounts or tokens through counting behavior and broadens access beyond the skill's declared child-danger recognition scope.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, network access, and likely environment-backed configuration, but it does not declare permissions or present clear boundaries for those capabilities. That mismatch increases the chance of over-privileged execution, hidden data flows, and unsafe operation in environments that rely on declared permissions for policy enforcement.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill's stated purpose is real-time child-dangerous-behavior recognition, but the documentation expands it into cloud history retrieval and report-link browsing. This broadens the data-access scope from current analysis to stored records, creating additional privacy and authorization risk, especially because child-safety reports may contain sensitive household or childcare monitoring data.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Automatic internal identity handling and fallback/default-user creation are not necessary for core video hazard recognition and can silently bind actions and reports to the wrong identity. In a child-monitoring context, that can expose another user's historical reports or intermingle sensitive records without the operator realizing it.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The documented API describes pet health analysis endpoints, which materially conflicts with the declared purpose of a child-dangerous-behavior recognition skill. This kind of cross-domain mismatch is dangerous because it can indicate code/documentation reuse, misrouting of sensitive uploads, or accidental connection to the wrong backend, causing child-safety images/videos and related data to be processed by an unrelated service.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The script contains a hidden account-context feature: it resolves an internal OpenID and uses it for the --list flow even though the skill’s stated purpose is just video-based dangerous-behavior recognition. This creates an unnecessary identity-linked data access path that may expose prior analysis records or account-scoped data without clear user awareness or purpose limitation.

Intent-Code Divergence

Low
Confidence
81% confidence
Finding
The inline comment says the tool does not require user input for identity and hides that behavior from the CLI help, but the code still resolves account context through OpenID-backed logic. This mismatch reduces transparency and can mislead users about when identity-linked data is being used, increasing the risk of undisclosed account scoping or privacy surprises.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary http/https video URLs and forwards them to the backend analysis service, which expands its scope from local child-safety monitoring to remote content ingestion. This can enable unintended third-party fetching, privacy issues, and processing of untrusted remote resources not implied by the manifest.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill manifest describes real-time child-danger alerting, but the script also exposes a history-listing function via `skill.get_output_analysis_list(open_id=open_id)`. That creates a scope mismatch and may expose previously analyzed child-safety videos or metadata without that capability being clearly declared, increasing privacy and authorization risk in a highly sensitive context involving minors.

Intent-Code Divergence

Low
Confidence
78% confidence
Finding
The CLI hides `--open-id` from help and labels it as an internal compatibility parameter, yet the `--list` path relies on `ConstantEnum.CURRENT__OPEN_ID` after `OpenIdUtil.resolve_current_open_id(...)`. This implicit dependency on hidden identity state can cause users or calling systems to retrieve history under an unexpected account context, which is risky when the data may contain sensitive records about children and home/nursery monitoring.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes generic HTTP CRUD helpers that can send arbitrary GET/POST/PUT/DELETE requests to caller-supplied URLs, which is substantially broader than the declared child-safety behavior recognition purpose. In a skill context, such broad network capability increases the attack surface for unexpected data exfiltration, unauthorized remote actions, or repurposing the skill as a general API client if higher-level controls are weak or bypassed.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The get_download_url helper enables remote resource access behavior that is not reflected in the manifest's narrow safety-detection description, creating hidden capability for retrieving downloadable resources via arbitrary object keys. In a monitoring skill used around children, undocumented remote resource management is concerning because it can facilitate access to or movement of sensitive image/video artifacts or other stored data beyond the expected detection workflow.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The file defines generic user-account persistence, including identity and account lookup behavior, which does not align with a child-dangerous-behavior recognition skill. Such capability expansion increases attack surface and raises the risk of hidden data collection or repurposing of the skill for unrelated user tracking.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The model stores highly sensitive fields such as token and open_token, along with identity fields like username, realname, email, birthday, sex, and age, without any visible justification tied to detecting dangerous child behavior. In this skill context, collecting and retaining authentication and identity data is unusually dangerous because it enables account compromise, privacy violations, and profiling of children or guardians if the local database is accessed.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility layer performs automatic remote login/registration and persists returned user tokens locally, which is unrelated to a child-danger recognition skill's stated purpose. That creates hidden identity provisioning and networked account management behavior that can expose user identifiers, create unintended accounts, and expand the skill's trust boundary far beyond safety monitoring.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code inspects environment-derived workspace locations and reads identity-related files from the workspace data directory, behavior that is not necessary for recognizing dangerous child behavior from sensor/video input. In the context of this skill, such host-context discovery and identity lookup increase privacy risk and can enable cross-workspace data access or silent reuse of local credentials.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The history-report trigger phrases are broad enough to match ordinary user requests, which may cause unintended execution of cloud report listing instead of the user's intended task. In this context, accidental triggering could disclose sensitive historical monitoring metadata or links about children and household activity.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill says uploaded media is automatically saved as a local file, but it does not provide a clear user-facing warning, retention limit, or handling policy. Because the media may contain children, homes, and surveillance footage, silent local persistence materially increases privacy and data-exposure risk.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documentation states that the API uses API key authentication and supports file upload, but provides no warning about the sensitivity of uploaded content or handling requirements. In this skill's context, uploads may contain images or video of children in homes, kindergartens, or nurseries, so omitting privacy and data-handling guidance increases the risk of unsafe collection, transmission, or misuse of highly sensitive data.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The export endpoint is described as providing a full report export without any caution about the sensitivity of exported data. For a child monitoring skill, exported reports could include behavioral events, timestamps, imagery-derived conclusions, or other sensitive records, making bulk exfiltration or over-sharing more likely if operators are not warned and controls are not emphasized.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The analysis function sends local video inputs or remote URLs to an external analysis backend through skill.get_output_analysis without any explicit user warning, consent prompt, or privacy notice. Because the content is child-safety video, the data may contain highly sensitive footage of minors and home or school environments, making silent transmission particularly risky.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script silently resolves an internal OpenID and uses it to retrieve analysis lists, without clear user disclosure in the interface. Hidden identity use can expose account-linked history or metadata and is especially sensitive in a child-supervision context where records may reveal minors’ behavior patterns, locations, or timestamps.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill reads entire local video files and transmits their contents to an analysis service without any user-facing notice in this code path. Because the skill is for child-safety monitoring, the uploaded media may contain sensitive footage of children and homes, making silent transfer a meaningful privacy and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debug logging can emit full request and response details, which may include tokens, identifiers, and potentially sensitive payloads. Even if intended for development, this creates a realistic leakage path through console logs or centralized logging systems without any user-facing warning.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2