Child Outdoor Activity Duration Monitoring | 儿童户外活动时长监测

• Outcome: Review
• Latest audit: Aug 28, 2026 · 10:49 PM UTC
• Version: 1.0.10

Overview

This child video-monitoring skill needs review because it can upload home footage to remote APIs and bind reports to silently managed identities and stored tokens.

Install only after confirming that the publisher's privacy terms, retention/deletion controls, access controls, and token-storage practices are acceptable for minors' home footage. Users should understand that analysis and report history are cloud-backed, identity-linked, and not a local-only workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The manifest exposes capabilities consistent with shell execution, file access, environment access, and networking, but does not declare permissions or clearly communicate them to users. This creates a transparency and trust problem: a user may believe the skill only performs local visual analysis while it can also access local resources and remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to perform child outdoor-activity monitoring, but the underlying behavior includes account creation/login, token handling, persistent identity storage, cloud history retrieval, and backend delegation not disclosed in the core description. This mismatch is dangerous because it hides sensitive data flows involving minors' video/activity data and identity-linked records from users and reviewers.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest frames the skill as a monitoring/reporting tool, but also describes cloud history lookup and app-style reminder/report-link workflows beyond the apparent local analysis scope. In a child-monitoring context, undisclosed expansion of processing and storage increases privacy risk because users may not expect long-term remote retention or secondary use of behavior records.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Automatic cloud history lookup combined with persistent user identity association is not clearly necessary for simple visual event counting and materially increases the sensitivity of the system. Because the data concerns minors and home-entry behavior, linking records to stable identities raises privacy, surveillance, and unauthorized-access risks if mishandled or exposed.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS URLs and uploads arbitrary supported files to a backend analysis service, despite claiming a narrow fixed-camera child-monitoring purpose. This broad input surface can be abused to process unintended remote content, potentially enabling privacy violations, policy bypass, or misuse of backend analysis resources outside the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file exposes a generic wrapper for arbitrary HTTP GET/POST/PUT/DELETE operations plus broad CRUD helpers, which materially exceeds the stated purpose of monitoring child outdoor activity duration. In an agent-skill environment, such reusable network primitives can be repurposed by other code paths to contact unintended endpoints, move data off-device, or perform unauthorized remote actions, increasing the attack surface even if this file alone does not show active abuse.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file defines a generic DAO plus a persistent user-account model including identity fields and tokens, which materially exceeds the manifest's stated purpose of child outdoor-activity monitoring. This kind of capability expansion increases privacy and abuse risk because the skill can store account-linked data unrelated to the declared function, especially concerning in a child-monitoring context.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The User model stores identity attributes and sensitive token/open_token fields despite the skill description focusing on counting entry/exit events and total outdoor duration. In a child-focused household surveillance skill, collecting and persisting extra identity/authentication data broadens the attack surface and can enable account compromise or cross-context tracking if the local database is accessed.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This shared utility performs account bootstrap, token retrieval, persistence, and authenticated external API calls that are unrelated to the declared child outdoor-activity monitoring behavior. That mismatch materially increases risk because the skill can silently establish external identities and transmit data/tokens off-device under a generic request wrapper, expanding its capabilities far beyond the user-expected scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code derives identity from a local API-key file and, if absent, creates and persists fallback user identities in local storage. For a camera-based child activity monitor, this hidden identity lifecycle is out of scope and dangerous because it enables attribution, tracking, and downstream network actions under a synthetic or reused user identity without clear user awareness.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The broad trigger phrases for history-report queries could cause the skill to activate cloud record retrieval in response to generic report-related requests. That increases the chance of unintended disclosure of sensitive child activity history or over-collection beyond the user's actual intent.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The documentation does not clearly warn that local videos, remote URLs, and derived child-activity data may be transmitted to cloud/API services and stored for history access. This is particularly dangerous because the data concerns minors, home locations, and behavior timelines, which users may reasonably expect to remain local unless explicitly told otherwise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document describes API Key authentication and a report export endpoint for a child-monitoring system that processes highly sensitive household and behavioral data, but it provides no privacy, access-control, or data-handling safeguards. In this context, weakly documented authentication and unrestricted export semantics can lead to unauthorized access, mass report extraction, and exposure of children's movement patterns and family routines.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code reads full local file contents and forwards them to an analysis API without any visible disclosure, consent flow, or minimization controls in this component. In a home-monitoring context involving child and household video, silent transfer of local media materially increases privacy risk and can lead to unexpected exfiltration of sensitive footage.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The function accepts either a local path or a remote URL and forwards it to `skill.get_output_analysis` with no visible disclosure, consent, or validation around remote processing. In the context of a home/child-monitoring skill, this can expose sensitive household video to external services or cause the backend to fetch attacker-controlled URLs, increasing privacy and SSRF-style risk depending on downstream implementation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Sensitive tokens are persisted in a local SQLite database as ordinary string columns, with no evidence of encryption, hashing, scope reduction, or disclosure. If the database file is read by another local process, copied from disk, or exposed via backup/logging mishandling, these tokens could be used to impersonate users or access linked services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debugging can log full request/response details, which may include sensitive payloads, identifiers, tokens, or behavioral data. In a household monitoring context, such logs can expose private child-related activity and backend credentials to local users, logs, or support channels.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill reads a workspace API-key file to derive an identity value without any visible user prompt or purpose limitation. In context, this allows the monitoring skill to appropriate local credentials or identifiers from its environment, which is especially problematic because the manifest does not disclose credential harvesting or account binding behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code auto-generates and persists a default user identity in the local database when no identity is supplied. This is risky because it silently establishes a durable identity for later authenticated operations, enabling tracking and backend interactions beyond the stated child activity monitoring purpose.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code automatically invokes an external phoneLogin endpoint with silent/register flags to create or obtain an account for a username/openId. Automatic registration/login without explicit disclosure or consent is dangerous because it can create backend accounts tied to local identities and transmit personal metadata off-device unexpectedly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The general HTTP wrapper injects identity fields, app identifiers, tenant data, and authentication tokens into outbound requests and can retry authorization flows automatically. In this skill context, that creates a broad exfiltration and account-use surface inconsistent with a simple local monitoring function, and it increases the blast radius if the utility is reused by untrusted callers or misconfigured endpoints.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: The requests.post call transmits an identity-bearing payload containing openId/mobile/source to an external service. External transmission is particularly concerning here because the skill description focuses on local child movement monitoring, not remote account provisioning, so the network behavior is unexpected and privacy-impacting.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-child-outdoor-activity-monitor-analysis"
description: "Using a fixed camera at the balcony door or home entrance, the system detects how many times the child enters/exits the home or balcony. With person-tracking and region-entry/exit logic, it records the timestamps of each 'leaving indoor (outdoor)' and 'returning indoor' event, and accumulates the daily total outdoor-activity duration. | 通过家庭阳台门或入户门口的固定摄像头，检测儿童进出家门或阳台的次数，利用人体跟踪和区域进出判定技术，记录每次离开室内（外出）和返回室内（归来）的时间点，累计每日户外活动总时长。当当日总时长低于预设推荐值（默认建议学龄儿童每天至少1小时户外活动）时，输出'户外活动不足'提醒，建议家长带孩子增加户外时间。"
version: "1.0.11"
license: "MIT-0"
---

• Confidence: 69% confidence
• Finding: The metadata contains indicators consistent with manifest/tool-schema poisoning heuristics, likely due to unusual description formatting and hidden-character artifacts. In this context, that matters because manifest metadata influences automated routing and trust decisions, so malformed or poisoned metadata can mislead systems about the skill's actual behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2