Child Social Interaction Frequency & Duration Analysis | 儿童社交互动频次与时长分析

• Outcome: Review
• Latest audit: Jul 27, 2026 · 5:50 PM UTC
• Version: 1.0.9

Overview

The skill matches its stated child-video analysis purpose, but it silently manages account identity, persists tokens, and sends highly sensitive footage and reports to remote services.

Review before installing. Use this only where you are authorized to process children's classroom or playground video and to send it to the configured remote service. Treat generated reports, low-interaction flags, and export links as sensitive child data. Check whether automatic identity creation, local token storage, and historical report access are acceptable in your environment, and prefer a deployment with explicit consent, retention, deletion, and access-control procedures.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill manifest declares no permissions, yet the documented workflow and detected capabilities indicate access to environment variables, local files, network, shell execution, and file writes. This creates a dangerous transparency gap: operators may trust the skill as low-risk while it can perform sensitive actions such as invoking scripts, persisting data, and calling remote APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to perform child social-interaction analysis, but the described behavior includes hidden identity creation, remote login/token acquisition, local token persistence, and history/report listing that are not central to the declared function. In a context involving minors' video and behavioral reports, undisclosed account provisioning and storage materially increase privacy, consent, and data-exposure risk.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documented endpoints broaden the feature from narrowly scoped social-interaction analysis into generic health-analysis and report-export workflows, increasing the chance of access to data or operations beyond the declared skill purpose. In a system handling children's video-derived behavioral data, this scope expansion raises the risk of overcollection, unauthorized reporting, and misuse of sensitive records.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Using class rosters for stable child identity linkage moves the system from anonymous interaction analytics toward identifiable child tracking. That materially increases privacy risk because roster data can connect behavior patterns, interaction frequency, and inferred social standing to named minors.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Flagging low-interaction children and generating teacher alerts exceeds simple aggregate heatmap/reference output and creates individualized behavioral profiling of minors. Such outputs can stigmatize children, produce false inferences such as exclusion or developmental concerns, and drive inappropriate interventions based on limited visual signals.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script initializes an internal identity via OpenIdUtil.resolve_current_open_id and exposes a --list mode that retrieves prior analysis results for the current open_id, functionality not justified by the stated purpose of one-off classroom video analysis. In a child-behavior analysis context, this creates a meaningful privacy and data-access risk because historical analyses may reveal sensitive information about children, classrooms, and institutional activity without clear authorization checks visible in this file.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The CLI accepts arbitrary remote URLs for video input even though the skill is described as analyzing fixed-camera footage from controlled environments. This expands the data-ingestion surface, can enable unauthorized external content processing, and may lead to privacy, policy, or SSRF-style risks depending on how downstream `skill.get_output_analysis()` fetches the URL.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The code exposes a history-listing function for prior analyses that is not reflected in the stated skill behavior. Undisclosed access to historical analysis records can leak metadata or prior results, especially in a child-monitoring context where past interactions are sensitive.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The methods http_post/http_put/http_get/http_delete accept an arbitrary url and forward requests through RequestUtil without any visible restriction, allowlist, or validation. In a skill whose declared purpose is fixed-camera child social-interaction analysis, this broad outbound network capability is unjustified and increases the risk of data exfiltration, SSRF-like access to internal services, or use of the skill as a generic network client.

Context-Inappropriate Capability

Medium

• Confidence: 69% confidence
• Finding: The User model stores token and open_token values in a local SQLite database without any visible encryption, hashing, access controls, rotation policy, or minimization. In a skill analyzing children in educational settings, retaining authentication-like secrets without clear necessity increases the consequences of local file compromise and broadens the privacy/security exposure beyond the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility module goes far beyond the manifest’s stated child social-interaction video analysis purpose by implementing identity resolution, local account persistence, token handling, remote authentication, and generic authenticated API requests. In this skill context, those hidden cross-cutting capabilities are dangerous because they enable account bootstrap and outbound operations unrelated to classroom video analytics, increasing the risk of covert data access or platform abuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can silently call a remote `/sys/phoneLogin` endpoint with `register=1` and user-derived identifiers to retrieve or create an account. That is unjustified for a video social-interaction analysis skill and creates an undisclosed pathway for account creation, identity linkage, and remote service enrollment.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The workspace-detection logic inspects environment variables, script paths, and parent directories to locate broader `workspace`, `data`, and `skills` locations. In isolation this is not always malicious, but in this skill context it grants filesystem awareness and reach well beyond the declared analytics function, increasing the chance of unintended access to other agent assets or persistent state.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code reads local identity state from `data/smyx-api-key.txt`, queries a local database for prior users, and creates persistent default identities when absent. For a classroom social-interaction analysis skill, that persistent identity management is off-scope and dangerous because it silently establishes and reuses user/account context without clear user awareness.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger activates on broadly defined user inputs involving kindergarten or playground videos, which can cause the skill to run without sufficiently specific user intent. Because the skill may save files, invoke scripts, and contact remote services, unintended invocation can lead to unnecessary processing or disclosure of sensitive child-related media.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The keyword activation list includes broad behavioral and medical-adjacent terms such as isolated children, exclusion, and autism screening, without tight qualification. This raises the risk of accidental activation in sensitive conversations and may cause the system to process protected child data or produce stigmatizing outputs based on ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes collecting and analyzing children's video and social-interaction data without any privacy, consent, lawful-basis, or retention guidance. Because the subjects are minors and the processing includes behavioral monitoring, the missing safeguards substantially increase legal, ethical, and misuse risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Providing a complete report export endpoint without any warning or restrictions is risky because exported files can contain sensitive child interaction histories that are easy to copy, share, or store insecurely. Export functionality often bypasses application-layer visibility and amplifies the blast radius of a single authorized or compromised account.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The tool processes highly sensitive video involving children from local files or remote URLs without any user-facing privacy notice, consent prompt, or warning about transmitting or analyzing personally sensitive content. In this context, omission of privacy safeguards is materially risky because operators may upload regulated or consent-restricted footage without understanding retention, sharing, or downstream processing implications.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This code uploads local video content or forwards a remote video URL to an external analysis service without any visible consent, disclosure, or confirmation step in this file. Given the skill processes kindergarten/early-education child social-interaction video, the data is highly sensitive and may contain minors' biometric and behavioral information, making silent transfer especially risky from a privacy and compliance perspective.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script supports a hidden `--api-key` parameter suppressed from help output, which reduces transparency around credential use and can mislead operators about secret handling. Hidden credential paths often bypass normal user review, increase accidental exposure risk, and are especially concerning in a networked skill processing sensitive child video.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The analysis function sends video for API-backed processing without any explicit warning that data may leave the local environment. Because the skill processes videos of children in educational settings, silent remote transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: When the target config file does not exist, the loader silently creates directories and writes a new config file without notifying the caller, and exceptions are suppressed. Silent filesystem modification can undermine auditability and user expectations, especially in shared or restricted environments, and may create configuration files in unintended locations if the path is influenced upstream.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The save routine writes configuration to disk and suppresses all exceptions, giving callers no indication that a write occurred or failed. Silent writes and silent failures are dangerous because they reduce transparency, can hide unintended persistence of sensitive settings, and complicate forensic review or secure operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function reads a sensitive identity value from a local API-key file in the workspace and uses it as an internal identifier without any visible disclosure or consent flow. In this context, silently harvesting workspace identity state is risky because it can bind the skill’s remote activity to a local account or operator unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2