Student Classroom Engagement Analysis | 学生课堂情绪参与度分析

• Outcome: Review
• Latest audit: Oct 12, 2026 · 11:22 PM UTC
• Version: 1.0.14

Overview

This skill should be reviewed before installation because it analyzes student classroom video through a cloud service and keeps persistent user/report credentials despite anonymity-focused wording.

Install only if the school or administrator has explicit consent, a retention/deletion policy, and approval to send classroom video and derived engagement reports to the configured cloud service. Treat the local workspace database as sensitive because it can hold account identifiers and tokens, and do not use the outputs for student ranking, discipline, or individual evaluation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (52)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The User model persists direct identity and account-linked fields including username, realname, email, birthday, age, token, and open_token, which directly conflicts with the manifest claim that no identity is stored. In a classroom-monitoring context involving minors or students, this sharply elevates privacy, compliance, and misuse risk because engagement observations could be linked to real people and tokens could enable broader account compromise.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of filesystem access, persistent user/open-id identity creation, local data/database writes, network login/registration, and token management directly conflicts with the skill's stated anonymous, non-identity classroom engagement purpose. In the context of analyzing minors on camera, this is a severe privacy and trust violation because it enables durable linkage between sensitive classroom analytics and user identities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation states that no identity is stored and only anonymous real-time reminders are used, yet it also introduces cloud-based historical report querying and persistent per-user report association. This contradiction is dangerous because it materially misrepresents the data lifecycle and may cause schools or parents to consent under false assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic creation or reuse of internal user identities is not necessary for the stated function of anonymous classroom engagement analysis and introduces avoidable identity linkage. In a minors' monitoring context, silently assigning persistent identities increases the chance of covert profiling and weakens consent and transparency guarantees.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The show_analyze_list flow retrieves stored analysis results via skill.get_output_analysis_list(open_id=open_id), which directly conflicts with the manifest claim that the system provides anonymous real-time reminders and does not store identity. In a classroom setting, retaining and listing past engagement/emotion analyses can expose sensitive behavioral data about students and create privacy, compliance, and misuse risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file defines shared user-account persistence that is materially unrelated to the declared classroom-engagement function. In the context of a skill claiming real-time, no-identity student analysis, adding reusable user-account storage broadens the data-collection surface and creates unjustified retention and cross-feature correlation risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares broad operational behaviors such as shell, network, file access, and environment use, but does not constrain them with explicit tool scope or permissions. In a skill that handles classroom video and historical cloud queries, this increases the attack surface and makes it harder to verify that execution is limited to the minimum necessary capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The notes prohibit long-term storage of raw video or identifiable data, but elsewhere the workflow supports historical cloud report retrieval and persistent identity-linked report association. Even if raw video is not retained, persistent report storage tied to identities can still preserve sensitive inferred data about minors and classroom behavior over time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown instructs that historical analysis report output must be automatically converted into a specific Markdown format, and the surrounding document consistently prescribes Chinese-language output examples and labels without offering the user a language choice. This creates a locale/language constraint that is not presented as optional or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The method returns a fixed Chinese string for the analysis header with no visible option to select another language or locale. This can violate organizational language policy when a skill enforces one language regardless of user preference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code exposes a hidden listing path through --list combined with an internally resolved open_id, even though the skill is presented as a real-time classroom analysis tool. Hidden retrieval functionality for prior analyses expands the data-access surface and can enable unauthorized review of historical student-related outputs, which is especially sensitive in an educational surveillance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code presents the tool description, argument help text, status messages, and error messages only in Chinese. That enforces a specific language/locale for all users without any documented opt-in or alternative, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2