Child Separation Anxiety Detection (Pre-School Crying) | 儿童分离焦虑识别（上学前哭闹）

• Outcome: Review
• Latest audit: Aug 25, 2026 · 11:58 PM UTC
• Version: 1.0.9

Overview

The skill appears to perform the advertised child video analysis, but it also sends sensitive minor-related media and report history to external services while silently creating or reusing cloud-linked identities and storing tokens.

Install only if you are comfortable sending child/caregiver videos, media URLs, account identifiers, and report history to the skill provider's backend. Obtain guardian and school consent first, avoid ambiguous history queries, review who can access exported reports, and ask the publisher for retention, deletion, authorization, and token-storage details before using it with real children.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 83% confidence
• Finding: This method accepts caller-supplied filter keys and resolves them with getattr(self.__model__, key) without validating the field name against an allowlist. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still query on unintended model attributes or trigger errors, which can enable unauthorized data access patterns or denial-of-service through malformed requests. In this skill context, the DAO backs user records containing identity and token data, so overly flexible querying is more sensitive than it would be in a purely local, non-sensitive dataset.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 81% confidence
• Finding: Like list(), this count() method dynamically resolves caller-provided filter keys without restricting which model fields may be queried. Even without SQL injection, this can support unauthorized probing of sensitive user-table state or cause predictable exceptions that leak schema behavior; because this skill stores usernames, real names, email addresses, and tokens, flexible counting by arbitrary fields increases privacy and enumeration risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises only behavioral analysis, but its instructions invoke shell execution, network access, local file handling, and implicit identity/state management without declaring permissions or clearly constraining those capabilities. In a skill that processes highly sensitive child video and report data, this mismatch undermines informed consent, reviewability, and least-privilege, increasing the risk of covert data access or exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill extends beyond one-off local/video analysis into automatic cloud history retrieval and report-link generation, which materially broadens data access beyond the stated purpose. Because the data concerns minors and emotional/behavioral assessments, undisclosed secondary access to historical reports creates a significant privacy and scope-creep risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatic initialization, reuse, or creation of internal user identities introduces account linkage and persistence behavior unrelated to basic video analysis. When combined with sensitive child monitoring data, silent identity binding can associate reports across sessions without transparent consent, enabling unauthorized access patterns or long-term profiling.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The history-listing capability introduces access to prior analysis records by user-scoped identifier, which is unrelated to the advertised single-video analysis function and may expose sensitive behavioral data about children. In this context, analysis history is especially sensitive because it concerns preschool emotional state and likely constitutes private child data; if OpenId resolution or authorization is weak, users may retrieve records they should not see.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This file exposes a broad generic API client surface including arbitrary GET/POST/PUT/DELETE wrappers plus generic add/edit/delete/list helpers, which substantially exceeds the skill’s declared purpose of narrow video-based separation-anxiety analysis. In a privacy-sensitive child-monitoring context, this capability expansion increases the risk that the skill can access, modify, or transmit unrelated backend data and makes abuse or hidden secondary functionality harder to constrain or audit.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The get_user_by_username capability introduces user-account lookup functionality that is not justified by the stated purpose of analyzing preschool drop-off videos. In a system handling sensitive child and family data, such identity-query functionality can enable user enumeration, unauthorized correlation of identities, or backend data access beyond the declared use case.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill manifest describes video-based separation-anxiety analysis for children, but this file implements a reusable user-account DAO with persistence of user identities and account-like records. That capability materially exceeds the declared purpose and expands the attack surface toward identity handling, persistence, and account correlation without clear necessity; in a child-focused surveillance context, unjustified user-data management raises the severity because it can link sensitive behavioral observations to identifiable individuals.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores username, real name, email, birthday, age, and especially token/open_token fields, none of which are justified by the manifest’s narrow purpose of classifying separation-anxiety level from video. Collecting and persisting identity and authentication material alongside child emotional-analysis data creates unnecessary privacy, credential-exposure, and cross-context tracking risk, which is particularly serious given the child-related nature of the skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote account creation/login and token acquisition that are unrelated to the stated local child video analysis purpose. This creates hidden network-side identity provisioning and authenticated backend coupling, which can exfiltrate user-associated identifiers and enable unauthorized service access without clear user knowledge or necessity.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads workspace identity data from local files and persists or generates default user identities even when no explicit user identity was supplied. For a skill described as entrance-camera separation-anxiety analysis, this identity bootstrapping is unnecessary and increases privacy risk by silently creating durable identifiers tied to the workspace.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger activates on any provided video URL or file, which is overly broad for a skill intended for a narrow child drop-off behavioral-analysis scenario. This can cause the skill to process unrelated or sensitive media unexpectedly, leading to accidental collection, transmission, or analysis of data outside the user's intended scope.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The historical-report query can be triggered by broad keyword matching, making it easy to invoke retrieval of sensitive historical records unintentionally or through prompt ambiguity. In this context, the queried data concerns minors and behavioral observations, so accidental disclosure or overbroad retrieval is more serious than in ordinary content skills.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API documentation exposes an endpoint to export a complete report for a child behavioral/mental-health-adjacent assessment without documenting access restrictions, minimization, audit logging, or privacy warnings. In this skill’s context, the exported data likely includes highly sensitive information about minors, making unauthorized export or over-broad sharing a serious confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill accepts either a local video path or a remote video URL and forwards the content to an external analysis API, but this file provides no user-facing consent notice, privacy warning, domain restriction, or URL validation. Because the skill processes videos of pre-school children at homes or kindergarten entrances, the transferred data is highly sensitive and may expose minors, caregivers, location details, and behavioral information to third parties or attacker-controlled URLs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Enabling global HTTPConnection and urllib3 debug logging can expose request metadata and potentially sensitive request/response contents in logs. In a skill handling child-related video-analysis workflows and backend tokens, such logging increases the chance of privacy leakage and credential disclosure during debugging or misconfigured deployments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code automatically transmits identity fields such as openId and mobile to a remote login endpoint and may register a user implicitly. Doing this without an explicit user-facing disclosure or consent is a privacy and transparency failure, especially in a skill involving monitoring of preschool children.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Authenticated network requests automatically attach user-associated data such as tenantCode, skillHubName, skillPlatform, and pnaUserName, without clear indication that this data leaves the local environment. In the context of a child-focused analysis skill, this hidden metadata transmission heightens privacy and compliance concerns.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: This code performs an external POST to a remote login endpoint carrying identity-related JSON data. External transmission is especially sensitive here because the skill’s declared purpose is local behavioral analysis from fixed cameras, not remote identity onboarding or backend account provisioning.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2