Security audit
Security checks for vulnerabilities and agentic risk
This skill processes sensitive child/home video through a cloud service and silently creates or reuses account identity data with local token storage, so users should review it before installing.
Install only if you are comfortable sending child/home entrance or balcony footage to the configured Life Emergence cloud APIs and having reports tied to a locally persisted internal user identity. Before use, confirm guardian consent, understand where reports and tokens are stored, and avoid using it for unrelated household recordings.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
The available evidence indicates authenticated outbound HTTP requests, local user identity generation, API-key file reading, database access, and token storage, none of which are clearly disclosed by the child-monitoring description. In a household minor-surveillance context, that combination is especially sensitive because it enables identity correlation, credential exposure, and broad remote data transfer.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-child-outdoor-activity-monitor-analysis"
description: "Using a fixed camera at the balcony door or home entrance, the system detects how many times the child enters/exits the home or balcony. With person-tracking and region-entry/exit logic, it records the timestamps of each 'leaving indoor (outdoor)' and 'returning indoor' event, and accumulates the daily total outdoor-activity duration. | 通过家庭阳台门或入户门口的固定摄像头，检测儿童进出家门或阳台的次数，利用人体跟踪和区域进出判定技术，记录每次离开室内（外出）和返回室内（归来）的时间点，累计每日户外�
The documentation does not prominently warn that uploaded child video and derived reports may be transmitted to and processed by cloud services. In the context of footage from a home entrance or balcony involving minors, lack of clear disclosure undermines informed consent and heightens privacy, legal, and data-protection risk.
Automatic internal identity handling and default-user creation introduce silent account association and persistence unrelated to basic video analysis. For a skill involving minors and household footage, hidden identity creation materially increases privacy risk and may enable cross-session tracking without meaningful user awareness.
The User model persists sensitive identity and authentication-related fields including email, token, and open_token, yet the skill purpose does not clearly require storing account credentials or long-lived tokens. In the context of a child-monitoring skill, collecting and mutating this data is especially risky because it expands privacy exposure and could enable account compromise if the local database is accessed.
The utility silently provisions or reuses identities, performs remote login/registration, and persists tokens locally even though the stated skill purpose is child outdoor activity monitoring. This creates unjustified account linkage and data-flow expansion, enabling hidden authentication, tracking, and reuse of credentials across sessions or skills if the environment is shared or compromised.
The skill declares broad operational behavior that implies shell execution, file access, network access, and environment use, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because callers and reviewers cannot verify what capabilities the skill may exercise, increasing the risk of unintended file access, command execution, or data exfiltration.
The documentation expands the feature set to include cloud history lookup and app-push reminders beyond the core monitoring description. This scope expansion matters because it implies additional data retention, account linkage, and notification processing that users may not expect when providing sensitive child video.
The default trigger activates on generic provision of door/balcony video, which is broader than a tightly scoped child outdoor-activity use case. Overbroad triggers are dangerous because they can route unrelated sensitive household recordings into this skill and its remote processing path without sufficiently specific user intent.
The keyword trigger list includes broad parenting and health phrases that can match ordinary conversations unrelated to this skill's specific function. This increases the chance of inappropriate invocation and unintended processing of child-related media or history queries.
The document specifies continuous child monitoring via fixed cameras and tracking logic, but it does not include any explicit privacy notice, consent requirement, data-retention guidance, or warning about surveillance implications. Because this involves minors and household video monitoring, omission of privacy and transparency requirements can lead to unauthorized collection, misuse, or overcollection of sensitive behavioral data.
The string returned on this line is a fixed Chinese-language heading for analysis output. This imposes a specific language on users without any visible opt-in, fallback, or documented region-specific justification in the file, which matches the language/locale policy violation criteria.
The manifest describes a child entrance/exit and outdoor-duration monitor, yet the implementation exposes a pet_type argument and mutates ConstantEnum.DEFAULT__PET_TYPE, with CLI choices cat, dog, and other. This indicates the code is repurposed from a pet-analysis workflow rather than a child-specific monitor, creating a semantic mismatch between the declared skill behavior and the actual implementation surface.
Detected: suspicious.install_untrusted_source