Child Emotion Recognition Analyzer | 儿童情绪识别分析工具

• Outcome: Review
• Latest audit: Aug 28, 2026 · 7:26 AM UTC
• Version: 1.0.25

Overview

This skill should go to Review because it processes sensitive child surveillance media through a cloud API while silently creating or reusing identities and storing authentication tokens with limited user-facing disclosure.

Review before installing. Use only where guardians or institutions have clear authorization to process children's surveillance media, and only after confirming what service receives the files, how long media and reports are retained, how tokens are protected, and why a silent default account is created. The publisher should document privacy/consent terms, endpoint configuration, token storage, and cleanup controls before this is broadly trusted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 84% confidence
• Finding: Here getattr(self.__model__, key) uses keys from the caller-supplied filters dictionary. An attacker who can influence filter keys may access unexpected model attributes or trigger errors, enabling unauthorized querying on columns the caller should not control and potentially causing denial of service or data exposure through overly flexible query construction.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 84% confidence
• Finding: This count() path has the same issue as list(): caller-controlled filter keys are reflected into model attribute lookup without validation. That can expose unintended schema details, enable probing of sensitive fields, or crash requests when invalid/internal attribute names are supplied.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill manifest advertises no permissions while the documented workflow clearly requires shell execution, network access, local file reads/writes, and likely environment access. This mismatch undermines informed consent and platform security review because operators may approve or invoke the skill without realizing it can persist data locally and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is child emotion recognition, but the skill also appears to create or reuse backend identities, perform automatic account registration/authentication, store tokens locally, and query historical reports. Hidden identity creation and credential/token persistence significantly expand the trust boundary and can expose sensitive child-related surveillance data or enable unauthorized access to backend records.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script exposes history retrieval by open_id through `show_analyze_list`, which can reveal prior analysis records beyond the stated real-time emotion-recognition purpose. In a child-surveillance context, historical records are highly sensitive, and exposing list access without visible authorization checks in this layer increases privacy and data-minimization risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file exposes generic CRUD and arbitrary HTTP helper methods that can call caller-supplied URLs, which goes beyond a narrowly scoped child-emotion-recognition function. In a surveillance-oriented skill handling children’s data, such broad network primitives enlarge the attack surface and can be repurposed for unauthorized data exfiltration, command-and-control style traffic, or misuse against unrelated backend APIs.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The add, edit, and delete wrappers provide unrestricted remote modification primitives using arbitrary URLs with no visible guardrails, policy checks, or resource scoping. Because the skill context involves sensitive monitoring in homes and childcare environments, these primitives could be abused to alter backend records, configurations, notifications, or linked resources unrelated to the stated emotion-recognition purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A child-emotion-recognition skill should not need a generic user-account persistence layer as broad as this without clear justification. In this context, unrelated account management increases attack surface, broadens data collection, and suggests the skill may store personal identity data beyond what is necessary for emotion analysis.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The model stores token and open_token values even though the declared skill is for child emotion recognition from surveillance footage. In this context, collecting and persisting authentication artifacts is especially sensitive because the application concerns children and home/daycare surveillance, making unnecessary credential storage a significant privacy and account-compromise risk.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file adds a generic AI chat/agent invocation surface that is unrelated to the advertised child-emotion-recognition purpose. Unrelated agent execution capabilities increase attack surface and create a pathway for prompt-driven misuse or future command execution, especially because the function is framed as an agent launcher and accepts arbitrary prompts.

Intent-Code Divergence

High

• Confidence: 84% confidence
• Finding: The docstring and commented code claim subprocess-based invocation of an external agent, but the implementation uses a dummy empty dict and inconsistent result handling. This mismatch is dangerous because it obscures the real behavior, can bypass reviewer expectations, and suggests incomplete or intentionally concealed execution logic that may later be re-enabled without proper safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This utility layer creates and persists default user identities unrelated to the advertised child emotion recognition function, including generating usernames, reading identity values from workspace files, and storing them for reuse. That expands the skill's scope into covert identity provisioning and account state management, which can bind users or workspaces to backend identities without meaningful consent or clear disclosure.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs external phoneLogin/registration and token bootstrap logic automatically when tokens are absent, then persists returned tokens locally. For a surveillance-oriented child emotion skill, hidden account creation and login to external services is a serious overreach that can expose operators to unauthorized account linkage, backend tracking, and silent expansion of data sharing.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: This skill processes surveillance footage of children and derives emotional state, which is highly sensitive biometric and behavioral data. Omitting a prominent privacy and surveillance warning increases the risk of unlawful or nonconsensual collection, misuse in regulated settings, and unsafe deployment where guardians or institutions do not understand the sensitivity of the processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow says uploaded attachments are automatically saved as local files but does not warn users that sensitive media of children will be written to disk. Silent local persistence raises the risk of accidental exposure through backups, multi-user hosts, insecure permissions, or failure to delete temporary files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill mandates direct cloud API queries for historical reports without clearly warning users that report data is fetched from a remote service and linked to an internal identity. Because the reports concern children and surveillance-derived analysis, undisclosed remote retrieval can create privacy, consent, and cross-tenant access concerns if identity association is opaque or misconfigured.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This CLI processes highly sensitive media involving children and can submit local files or remote URLs for analysis, yet it provides no explicit privacy notice, consent check, retention statement, or warning that the content may be transmitted to a backend service. In the context of surveillance footage of minors, this omission materially increases the risk of unauthorized collection, disclosure, or non-compliant handling of biometric and behavioral data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill reads arbitrary local video files or forwards remote video URLs to an external analysis API without any visible consent, warning, or disclosure in this code path. Because the skill processes surveillance footage of children, silent transmission creates meaningful privacy and compliance risk, especially in homes, daycares, and schools.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The hidden `--api-key` parameter accepts credentials while being suppressed from help output, reducing transparency around secret handling and where credentials may be sent. Hidden credential paths are risky because users and reviewers cannot easily assess transmission, logging, or misuse, especially in a tool that processes sensitive child video data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The analysis path sends user-supplied local video paths or URLs to `skill.get_output_analysis` without clear disclosure that footage may be processed by an external service. Because the skill handles surveillance video of children, undisclosed remote transmission materially increases privacy, consent, and regulatory risk if users assume analysis is local.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: When the target config file does not exist, the code silently creates directories and writes a new YAML file, and all exceptions are suppressed. In a sensitive surveillance-oriented skill, silent state changes can hide unauthorized configuration creation, mask permission/path problems, and make security-relevant misconfiguration difficult to detect or audit.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The save routine blindly overwrites the specified path and suppresses all exceptions, which can conceal failed writes or unintended replacement of existing configuration. If an attacker can influence the path or contents elsewhere in the application, this pattern can enable destructive configuration tampering without visibility.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function reads a sensitive identity value from data/smyx-api-key.txt and uses it as an internal identity source without any visible user notice in this code path. Silent harvesting of identity material from workspace files creates a privacy and transparency problem and may cause unintended impersonation or backend association if the file was placed for another purpose.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The request wrapper automatically attaches user identity and authentication headers such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName to outbound requests. In a skill whose stated purpose is emotion detection from surveillance footage, undisclosed transmission of identity and auth data materially increases privacy risk and broadens the blast radius if endpoints, logs, or dependent services are compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This outbound POST sends identity-bearing registration/login data to an external health/backend endpoint, including openId, mobile, and source values. External transmission is expected for some cloud-backed skills, but here it is tied to automatic account provisioning unrelated to the declared child emotion analysis function, making the transmission privacy-sensitive and potentially deceptive.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2