Student Classroom Engagement Analysis | 学生课堂情绪参与度分析

• Outcome: Review
• Latest audit: Aug 26, 2026 · 11:17 AM UTC
• Version: 1.0.10

Overview

The skill performs classroom engagement analysis, but it also uploads student video, keeps cloud-accessible report history, and silently creates or reuses local account credentials.

Review this before installing in any school or child-facing setting. Confirm who operates the cloud API, where videos and derived reports are stored, how long reports and uploaded media are retained, who can access report links, how local tokens are protected and deleted, and whether school and parent consent covers cloud processing and historical report retrieval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 76% confidence
• Finding: This method uses attacker-influenced filter keys to dynamically resolve model attributes with getattr(self.__model__, key) and does not validate them against an allowlist. While SQLAlchemy still parameterizes values, untrusted callers can trigger unauthorized field-level querying, unexpected exceptions, or bypass intended business restrictions by probing internal columns.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 76% confidence
• Finding: Like list(), count() dynamically resolves column names from caller-provided filter keys without restriction. This can enable unauthorized querying over internal fields and can be abused for schema probing or logic abuse even if it does not directly cause SQL injection.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs use of shell commands, local file handling, network access, and environment-driven behavior, but it does not declare permissions or clearly constrain those capabilities. That gap weakens reviewability and makes it easier for a skill handling classroom video to access or transmit sensitive data without explicit operator awareness.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest promises anonymous, real-time-only analysis with no identity storage, but the documentation adds cloud history queries and persistent report links, implying retention beyond transient processing. For a system analyzing minors' facial expressions, this mismatch can mislead deployers about actual data lifecycle and create undisclosed tracking or retention risk.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Automatic local file saving and reuse/creation of a local default user exceed the stated anonymous real-time analysis model and introduce persistence on device. In a classroom setting, even 'temporary' saved media or user linkage can expose sensitive student data and enable later correlation across sessions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation says no identity is stored, yet elsewhere it describes automatic identity initialization, reuse, and creation of a local default user. This is a direct contradiction that can conceal account linkage or record association, especially dangerous when processing minors' behavioral and affective data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a historical analysis listing through `show_analyze_list(open_id, ...)`, which goes beyond the manifest's stated real-time, anonymous classroom engagement analysis. Because the function is tied to an internal user identifier, it creates a path for retaining and retrieving behavior-derived classroom data, undermining the claimed no-identity/real-time-only scope and increasing privacy and data-minimization risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code initializes and uses an internal identity mechanism via `OpenIdUtil.resolve_current_open_id(...)` and later reads `ConstantEnum.CURRENT__OPEN_ID`, despite the skill being described as anonymous classroom analysis with no stored identity. In a classroom video analytics context involving students, introducing internal identity linkage materially raises privacy, profiling, and unauthorized tracking risk, especially if combined with historical analysis retrieval.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI explicitly accepts an arbitrary `--url` and passes it to backend analysis, which expands the skill beyond the stated fixed-classroom-camera use case. This can enable analysis of untrusted remote media, creating policy drift and increasing privacy, compliance, and potential SSRF/downstream-fetch risk depending on how `skill.get_output_analysis()` handles URLs.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The `--list` path exposes historical analysis retrieval via `skill.get_output_analysis_list(open_id=open_id)`, which is not described in the manifest's real-time reminder/heatmap purpose. Undocumented history access increases the chance of unauthorized retention, secondary use of student monitoring data, and privacy violations, especially in a classroom context involving minors or sensitive educational observations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This file exposes broad generic network and CRUD primitives (`add`, `edit`, `delete`, `http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the classroom-engagement use case described in the manifest. In a skill that is supposed to perform real-time, no-identity classroom analytics, arbitrary request wrappers materially expand capability and make it easier for other parts of the skill to exfiltrate data, modify unrelated backend resources, or interact with unexpected services without purpose limitation.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The `get_user_by_username` capability directly conflicts with the stated no-identity, real-time-only behavior of the skill. Even if identity is not stored locally, adding user lookup enables linkage of observed classroom behavior to specific users, increasing the risk of deanonymization, profiling, and misuse of sensitive student data.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill manifest claims real-time, non-identity classroom engagement analysis, but this file defines persistent user storage with usernames, real names, emails, birthdays, ages, tokens, and open tokens. That is a significant scope mismatch and indicates collection and retention of identity and authentication data beyond what users and deployers would reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores account attributes and sensitive token material that are not necessary for the stated classroom engagement function. In an education setting, especially one involving minors, undisclosed identity and token persistence materially increases privacy, compliance, and account-compromise risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The utility code provisions or reuses user accounts, fetches tokens from a remote service, and persists authentication material locally, which is unrelated to the stated classroom-engagement function. In a surveillance-oriented education skill, hidden account creation and token storage materially increase privacy and platform-abuse risk because operator/user expectations are that identities are not stored.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code derives a persistent local identity from workspace files and a local database, and if absent generates one and stores it for future reuse. That conflicts with the skill description's claim of not storing identity, making it particularly dangerous in a classroom context involving minors because it creates durable linkage and tracking capability even if names are pseudonymous.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill supports sending classroom video files or remote URLs to an API, but it does not clearly warn users that sensitive student footage may be transmitted to a cloud service. Given the context of minors, facial-expression analysis, and possible persistent reports, the absence of an explicit transmission/privacy warning materially increases the risk of uninformed disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code accepts either a local video file or a remote video URL and forwards the content to an analysis service without any built-in user notice, consent check, or safety gating. In the context of classroom camera footage and inferred facial-expression engagement data about students, this creates a meaningful privacy and compliance risk because highly sensitive data may be transmitted off-device or to external services without explicit disclosure or policy enforcement.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debugging can emit verbose request/response details that may include sensitive headers, tokens, identifiers, and service responses. In this skill context, those logs may also reveal student-related telemetry or operational data without any user-facing disclosure.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The code reads an identity value from a workspace file and silently uses it as the current open-id. This creates undisclosed persistent identity reuse and can bind activity to a local operator or prior user, which is especially problematic for a skill advertised as not storing identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically attaches user identifiers and authentication tokens to outbound network requests and may also inject tenant and platform metadata. For a classroom analytics skill, undisclosed transmission of identifiers is more dangerous because it expands the risk of student/teacher activity linkage, remote tracking, and credential leakage beyond the claimed real-time local analysis behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 91% confidence
• Finding: This code transmits locally derived identity data to an external login/registration endpoint to create or recover an account. External transmission is not inherently unsafe, but here it is coupled with silent identity derivation and auto-registration, making the data flow risky and misaligned with the skill's stated classroom-only engagement purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2