ClawHub
Back to skill

Security audit

Child Window/Balcony Climbing Detection | 儿童攀爬窗户/阳台识别

Security checks across malware telemetry and agentic risk

Overview

This child-safety video skill has a clear purpose, but it sends sensitive footage or video URLs to a cloud service and silently manages account identity, tokens, and report history.

Review before installing. Use this only if cloud processing of child/home camera footage is acceptable, guardian consent is in place, and the backend's retention, access control, report-link expiry, and deletion practices are understood. Avoid connecting continuous private feeds or sensitive URLs unless you have verified authorization and storage controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
Using getattr(self.__model__, key) with caller-supplied filter keys enables unvalidated dynamic column selection. Although SQLAlchemy prevents classic SQL injection here, an attacker who can control filters may query on unintended attributes, trigger exceptions for invalid names, or bypass intended business restrictions by filtering on sensitive/internal columns.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
This count() method repeats the same unvalidated dynamic attribute access on externally provided filter keys. Even without raw SQL injection, it expands the query surface to internal model fields and can support unauthorized data probing or denial-of-service via repeated invalid-attribute requests if exposed through higher layers.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises substantial capabilities—shell execution, network access, local file read/write, and environment access—without declaring permissions or clearly disclosing that user files and data may be handled by code and remote services. This creates a transparency and trust boundary problem: operators may invoke the skill expecting documentation-only behavior while it can actually process local files, persist data, and communicate externally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose emphasizes local real-time safety monitoring and alerts, but the observed behavior expands into remote uploads, persistent identity/account initialization, local token/user-data storage, and cloud history retrieval. This mismatch is dangerous because users may submit sensitive child video under the assumption of local safety analysis, while the skill actually creates persistent cloud-linked records and broader data flows not made central in the top-level purpose.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill broadens from safety detection into cloud-based historical report querying and report-link retrieval, which materially expands the data surface from one-time analysis to persistent record access. In a child-monitoring context, historical reports and linked artifacts can expose sensitive behavioral timelines, images, and household activity if access control or disclosure is weak.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The AI role claims the skill only returns recognition and warning output, yet other sections instruct saving uploads locally and generating broader reports and recommendations. This inconsistency is risky because users may not realize their child-related media is being stored or repurposed beyond immediate detection, increasing privacy and data-handling exposure.

Intent-Code Divergence

Low
Confidence
85% confidence
Finding
The CLI suppresses visibility of identity-related parameters while still resolving a current open_id internally, which can obscure which user context is being accessed or acted upon. In a safety-monitoring skill handling household video analysis, hidden identity resolution increases the risk of unauthorized access to another user's analysis history or cross-account data exposure if the helper logic is weak.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, which expands the skill from local/fixed-camera child-safety monitoring into generic remote content ingestion. This creates scope creep and can enable unexpected processing of third-party or sensitive feeds, increasing privacy, compliance, and misuse risk beyond what the manifest describes.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The code generates export links for reports and exposes report retrieval/listing behavior that is not reflected in the manifest's described real-time warning function. Undocumented data access and export paths can expose historical analysis artifacts and make sensitive child-monitoring results more broadly accessible than users expect.

Context-Inappropriate Capability

Low
Confidence
77% confidence
Finding
The history-listing capability broadens access to prior analysis records beyond the narrowly described purpose of detecting dangerous child behavior from submitted video. In a child-safety context, analysis history may reveal sensitive household surveillance metadata or prior videos, so exposing this function without clear authorization boundaries increases privacy and data-minimization risk.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes a broad, generic API wrapper with unrestricted CRUD and arbitrary HTTP methods that are not narrowly scoped to the stated child-safety video-analysis purpose. In a skill ecosystem, such reusable network primitives can be abused by higher-level code to access unrelated services, exfiltrate data, or perform unauthorized actions, especially because methods like http_get/http_post/http_put/http_delete accept caller-supplied URLs and arguments with no visible allowlist or purpose limitation.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The file defines persistent storage for generic user identities and sensitive authentication material such as token and open_token, which is not justified by the declared child-window-climbing detection purpose. In this context, retaining account and token data broadens the privacy and compromise impact well beyond the safety-monitoring function and creates unnecessary sensitive-data exposure.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
This module implements broad shared-database and reusable user CRUD infrastructure that exceeds the manifest's narrow child-safety video analysis purpose. In a safety-monitoring skill, such general-purpose persistence increases attack surface, encourages cross-component data coupling, and raises the risk of collecting or sharing unrelated user data without clear need.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer silently performs remote account provisioning and token-based login flows that are unrelated to the declared child-safety video-analysis purpose. This creates an unexpected identity and network side effect: merely using the skill can register/login a user and obtain persistent tokens, which materially expands the attack surface and can enable unauthorized account creation or backend abuse.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code derives an active identity from workspace files, current globals, or a local database, and even creates a default user if none exists. In the context of a child-window-climbing detection skill, this is unjustified impersonation/bootstrap behavior that can cause requests to be attributed to a user without their knowledge or explicit selection.

Vague Triggers

Medium
Confidence
81% confidence
Finding
A default trigger that activates for any provided window/balcony video is overly broad and can cause the skill to process files the user did not specifically intend for this cloud-backed child-safety workflow. Because the skill context involves local file handling and likely remote upload of sensitive household video, over-triggering increases the chance of inadvertent privacy exposure.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The keyword trigger list includes broad everyday child-safety and home-safety terms, which may invoke the skill in contexts where the user did not intend remote analysis or history lookup. In this domain, accidental activation can expose highly sensitive child and household footage or metadata to backend services without meaningful user awareness.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explicitly requires 24/7 camera collection in domestic child-activity areas and describes downstream alerting outputs, but provides no privacy notice, retention limits, access controls, or consent guidance. In this context, always-on monitoring of children inside a home creates significant sensitive-data exposure risk if operators deploy it without safeguards or informed user awareness.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented report export endpoint suggests bulk or complete extraction of analysis results, likely including timestamps, alerts, and potentially child-related incident records, without any warning about sensitivity or authorization expectations. That omission increases the chance that implementers expose highly sensitive household monitoring data through overbroad export features.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Publishing a `snapshot_url` output field without warning about privacy or access-control requirements can lead implementers to expose direct links to images of children in private home environments. If such URLs are guessable, long-lived, or insufficiently protected, they could enable unauthorized viewing, sharing, or retention of highly sensitive images.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill reads arbitrary local video files into memory and sends their contents to the analysis service without any visible notice, consent flow, or transmission warning in this code path. Because these videos may depict children in private home spaces, undisclosed upload materially raises privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill forwards user-supplied remote video URLs to the analysis service without any visible disclosure that network resources will be fetched or processed externally. In a child-safety monitoring context, silent forwarding of camera/feed URLs can reveal private infrastructure or sensitive streams and surprise users about data exposure.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
Accepting a hidden --api-key parameter suppresses user visibility into credential use and handling, which can lead to insecure operator practices and accidental credential exposure in shell history, logs, or wrapper tooling. Concealing credential-related behavior is especially concerning in a skill that processes household/child surveillance data, because users may not understand what external service is being authenticated to.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The tool submits a local video path or remote URL to backend analysis without any explicit privacy or data-transfer warning, yet the content is likely to contain highly sensitive footage of children inside a home. In this context, silent transmission to an external service materially increases privacy, consent, and compliance risk if users do not understand where footage is processed or stored.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The code trusts an environment-derived workspace path and uses it to determine where skill data and files are read/written, without disclosure or validation. While not a direct exploit by itself, this can cause the skill to operate on sensitive directories or unintended agent workspaces if the environment is manipulated.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2