Child Social Interaction Frequency & Duration Analysis | 儿童社交互动频次与时长分析

• Outcome: Review
• Latest audit: Oct 14, 2026 · 5:34 AM UTC
• Version: 1.0.14

Overview

This skill is a child-video analysis client, but it automatically uses remote services, identity setup, and local token storage in ways users should review carefully before installing.

Review this skill only if you are comfortable sending child classroom/playground media and report queries to the configured Life Emergence remote services. Before installing, require clear operator consent, parent/guardian and school authorization, retention/deletion terms, endpoint and report-access controls, and a safer identity/token storage design. Treat any autism or developmental-screening output as non-diagnostic and require human professional review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate authenticated outbound HTTP requests, open-id resolution, token persistence, auto-registration/login, local file access, and workspace-path discovery, while the manifest presents a benign child-video analytics use case. In the context of sensitive media involving minors, undisclosed identity management and remote transmission materially increase privacy, compliance, and unauthorized-account-linkage risks.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-child-social-interaction-analysis-analysis"
description: "Using fixed cameras in kindergartens or early-education centers, the system analyzes multi-person video to detect social-interaction behaviors among children, including approach (distance < 1 m), conversation (face-to-face with mouth movement), and cooperative play (collaborative play, chasing, etc.). | 通过幼儿园或早教中心的固定摄像头，分析多人视频，检测儿童之间的社交互动行为，包括接近（距离<1米）、对话（面对面且嘴部运动）、共同游戏（合作玩耍、追逐等）。系统定期生成社交互动热力图，为教师

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores token, open_token, email, birthday, realname, age, and sex, all of which exceed the stated analytics-only purpose and include highly sensitive personal and authentication data. In a childcare setting this is particularly dangerous because it increases exposure of personal data and secrets without an obvious need tied to video interaction analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This utility provisions or reuses remote user identities and tokens, then persists them locally, which is unrelated to the stated purpose of kindergarten social-interaction video analytics. That creates hidden account linkage and credential storage behavior, increasing the risk of unauthorized outbound service use, token leakage, and cross-skill identity reuse without clear necessity or disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and documents capabilities that involve shell execution, file access, environment access, and outbound network use, but it does not declare any explicit tool scope or allowed-tools policy. In an agent environment, this creates an over-privileged and under-constrained execution surface where sensitive local data, credentials, or arbitrary remote endpoints may be accessed without clear enforcement boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill expands from interaction counting into identifying 'isolated/excluded' children and autism early-screening, which is a sensitive inference about minors that exceeds the stated scope. Scope creep into developmental or health-adjacent assessment increases the risk of harmful labeling, privacy violations, and deployment in contexts requiring much stricter validation and consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation says not to provide diagnosis, yet elsewhere markets the tool as an autism early-screening reference and includes diagnosis-oriented report triggers. Conflicting instructions are dangerous because they encourage downstream users or agents to infer medical significance from non-diagnostic outputs, especially for children.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The default trigger is broad enough to activate on essentially any uploaded kindergarten or playground multi-person video. In a sensitive minors-data context, overbroad activation can cause unintended processing and transmission of videos without a sufficiently explicit user request or confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad keyword-based auto-triggering for history-report queries can cause unintended access to prior records, especially when tied to hidden internal identity resolution. This raises the risk of exposing historical child-related reports without clear user intent or adequate authorization boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document describes APIs for analyzing children's social interactions and exporting full reports, including stable child IDs, interaction pairs, loner candidates, and alert hints, but provides no privacy, consent, retention, access-control, or sensitive-data-handling requirements. In a child-surveillance context, this omission materially increases the risk of exposing highly sensitive behavioral data, enabling misuse, overcollection, or insecure downstream integrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L17 hardcodes the user-facing output header in Chinese ("儿童社交互动频次与时长分析结构化结果"). For a general-purpose skill file, this is a natural-language locale choice imposed by the skill without any visible mechanism for user selection or documented justification, which fits the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing description, help strings, progress messages, and error output are all hard-coded in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified or alternatives are offered.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and surrounding CLI documentation consistently frame this skill as analyzing social interactions among children in kindergarten or early-education video. However, lines L043-L044 expose a --pet-type argument limited to cat, dog, and other, which directly contradicts the stated child-analysis purpose and indicates copied intent from a pet-analysis skill.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2