Back to skill

Security audit

Child Happy Moment Capture & Positive Reinforcement | 儿童开心时刻识别与正向激励

Security checks across malware telemetry and agentic risk

Overview

The skill is broadly aligned with child happy-moment video analysis, but it handles minors' video through cloud APIs with automatic identity creation, token persistence, history access, and broad URL ingestion that require careful review.

Install only if you understand that child video or video URLs may be sent to the publisher's cloud service, reports and export links may be retrieved from cloud history, and the skill may create or reuse a local identity with stored authentication tokens. Use it only with parental or venue consent, avoid public or multi-child footage unless authorization and masking are handled, and review local workspace data storage and account linkage before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill declares no permissions while its documented behavior clearly requires environment access, local file read/write, network access, and shell execution. This under-disclosure is dangerous because it prevents meaningful user review and hides sensitive operations involving child video, local persistence, and backend communication.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose emphasizes local happy-moment detection and capture, but the skill also creates persistent local identities, acquires backend tokens, and queries remote history. This mismatch is dangerous because users may consent to child-moment capture without realizing the skill performs account management and cloud-linked tracking operations involving highly sensitive child-related records.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Automatic cloud-based historical report querying expands the scope from event detection into retrieval of stored child-related records. In a surveillance context involving minors, unnecessary access to historical cloud data increases privacy exposure and the chance of over-collection or unauthorized disclosure.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Automatically creating and reusing a default local user identity introduces hidden account linkage and persistent tracking that are not necessary for simple video analysis. In a child-monitoring skill, silent identity creation increases the risk of misattribution, unauthorized reuse of another person's profile, and undisclosed long-term association of sensitive footage and reports.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill claims to avoid psychological analysis, yet it infers social context and trigger context such as praise, game wins, and interaction categories. For children, these inferences go beyond simple visual event detection and can become covert profiling of behavior and social relationships.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script exposes hidden identity-driven behavior through --open-id and --list, allowing retrieval of analysis history unrelated to the stated real-time video analysis purpose. In a child-monitoring context, this expands access to potentially sensitive historical records and creates an IDOR-style privacy risk if identities are supplied or resolved improperly.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code resolves an internal user identity for all operations even though the advertised function is media analysis, indicating hidden account-context behavior. In a system handling children's images and event history, implicit identity resolution can bind requests to internal accounts or expose another user's data if the resolution logic is weak or spoofable.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest describes analysis of fixed-camera footage from trusted environments, but the code also accepts arbitrary remote HTTP/HTTPS URLs. That expands the skill into a generic remote-content ingestion feature, which can enable unauthorized collection/processing of third-party child videos, SSRF-style backend fetching risks depending on the downstream service, and analysis of content outside the declared purpose.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The code constructs and exposes report export links, which is beyond simple real-time happy-moment detection/capture described in the manifest. Undocumented report retrieval capabilities can facilitate access to stored analysis artifacts and increase privacy exposure, especially because the subject matter is children's images and videos.

Context-Inappropriate Capability

Low
Confidence
81% confidence
Finding
Historical report browsing is not clearly necessary for the narrowly described detection workflow and increases the amount of accessible retained child-related data. In this context, extra browsing/listing functionality broadens data exposure and can enable enumeration or access to prior analysis records if authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Accepting arbitrary remote video URLs can enable server-side requests to attacker-controlled endpoints or internal network resources, depending on how downstream processing in skill.get_output_analysis retrieves the content. In this skill's context, which involves analyzing children's videos, broad URL ingestion also increases privacy and data-handling risk because it expands input sources beyond fixed trusted cameras.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This file exposes broad generic network primitives and CRUD-style helpers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`) that are not constrained to the child happy-moment capture purpose described in the skill metadata. In an agent skill context, such unrestricted wrappers expand the skill's capability surface and can be reused to access unrelated internal or external APIs, increasing the risk of data exfiltration, unauthorized actions, or hidden secondary behavior.

Context-Inappropriate Capability

Low
Confidence
81% confidence
Finding
The username lookup helper is unrelated to the declared camera-based child emotion/event detection function and introduces extra identity-resolution capability. Even if innocuous by itself, this kind of unrelated user-enumeration primitive can support account discovery, privacy violations, or chaining with other API methods to query or act on user data outside the stated purpose.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs remote account provisioning, token acquisition, token reuse, and authenticated API requests that are unrelated to the stated purpose of detecting happy moments from children's camera feeds. This creates an undisclosed outbound capability that can register identities, persist credentials, and transmit user/workspace-linked data to external services, which is especially sensitive in a child-monitoring context.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code reads workspace identity data from local files, derives default user identities, and persists/reuses account state in a local database despite this being unrelated to the declared behavior-analysis function. Hidden identity bootstrapping and persistence increases privacy risk, creates opaque tracking across sessions, and broadens the blast radius if the workspace is shared or compromised.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger is broad enough to activate on any uploaded camera video that 'needs analysis,' which can cause the skill to process sensitive footage unintentionally. In a child-surveillance setting, accidental invocation may lead to local saving, cloud submission, or analysis of minors' images without deliberate consent.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The keyword-based activation list uses broad phrases that can match normal parenting or video-analysis requests without clearly signaling surveillance, capture, or cloud reporting behavior. This raises the risk of unintended processing of children's media and over-collection of sensitive data.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill description does not prominently warn users that it involves sensitive surveillance of children, automated recording/capture, cloud-backed reporting, and local file saving. Missing disclosure is especially dangerous here because the data concerns minors in homes, schools, and playgrounds, where consent and privacy obligations are heightened.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This is a real privacy and safety issue because the document operationalizes continuous collection of children's video, facial expression, body movement, and optional audio in homes and public settings, but does not present a prominent user-facing warning about the risks of surveillance, consent, misidentification, and downstream exposure. Although some constraints are listed, the skill context involves minors and highly sensitive biometric/behavioral data, which materially increases the danger of misuse, over-collection, or deployment without informed consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This is a true vulnerability because the document defines APIs for result retrieval, history pagination, export, and push delivery of child snapshots/videos without an explicit warning about retention, onward transmission, unauthorized recipient risk, or leakage through exported artifacts and notifications. In the context of children's media, these distribution paths significantly raise the chance of privacy harm, especially if links, exports, or pushes are exposed to unintended viewers or retained too long.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The function sends user-supplied local files or remote URLs to an analysis service without any visible warning, consent prompt, or privacy notice in this code path. Because the skill processes videos of children, silent transmission materially raises privacy and compliance risk and makes misuse more dangerous than in ordinary media-processing contexts.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
In debug mode, the function logs the entire `prompt`, which may contain sensitive user data, child-related content, or internal instructions. In this skill's context—analyzing children's images/events—logged prompts could expose especially sensitive personal or behavioral information to logs, operators, or downstream systems.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt and later uses it in authentication/account resolution without any user-facing notice or consent. Secret or identity material stored in a workspace file should not be silently repurposed, particularly in a skill processing children's images and events.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2