Depression Behavioral Markers (Long Immobility & Appetite Change) | 抑郁症辅助行为标记（长时间不动、食欲改变）

• Outcome: Review
• Latest audit: Nov 13, 2026 · 2:59 AM UTC
• Version: 1.0.19

Overview

ClawScan marks this skill suspicious because scanners report that its account, identity, and remote data handling are not clearly aligned with its stated home-camera health-monitoring purpose.

Consider not installing until the publisher explains why account enrollment, identity and token storage, remote video processing, and the export-only behavior are needed and what data is sent or retained. The scan is marked partial because a referenced local path was missing, so the available evidence does not cover everything.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (22)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk is an account/API infrastructure module rather than a camera-behavior analysis implementation. Ordinary formatting, polling, and directory helpers could be supporting implementation details, but automatic identity provisioning, credential-file access, remote account registration, token persistence, and payment workflows introduce substantive behavior absent from the declared purpose. No camera ingestion, bed-rest measurement, eating-baseline comparison, multi-day detection, or health-report generation appears in this chunk. This assessment is limited to the supplied code and does not establish what other skill modules implement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied chunk is generic scaffolding with a disabled agent-call helper, rather than an implementation of the declared health-behavior monitoring workflow. It shows no active subprocess execution or other clearly undeclared external capability. Imported base classes and API-service implementations are not supplied, so their behavior cannot be assessed; this finding is limited to the visible code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied chunk centers on a sys_user database containing usernames, real names, email addresses, demographic information, and tokens. It implements no camera processing, bed-rest measurement, eating-baseline comparison, multi-day detection, or reporting. Database infrastructure could support the declared system, but this chunk specifically implements account management without a demonstrated connection to that monitoring workflow. The finding is limited to the supplied code; no token transmission or other exfiltration is shown.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-depression-behavioral-markers-analysis"
description: "Using fixed home cameras (bedroom and dining area), the system analyzes the multi-day behavior pattern of elderly people or solo-living individuals, detecting daily lying-in-bed duration (continuous lying > 20 hours per day) and a sharp drop in eating frequency / duration (e.g., daily eating-action count below 50% of personal baseline). | 通过家庭固定摄像头（卧室和餐厅区域），分析老年人或独居者连续多日的行为模式，检测卧床时长（连续卧床超过20小时/天）以及进食频次/时长骤减（如每日进食动作次数低于历史基�

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The documented --export-env-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The export-only flag promises not to perform analysis, but its value is never checked after argument parsing. When supplied with an input, execution still initializes identity and invokes analysis, potentially transmitting highly sensitive bedroom footage despite the user's explicit non-analysis mode.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local input files are passed to an API for analysis without disclosing the upload to the user.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The local-file branch reads the entire video and passes its raw contents to the analysis API without an upload-specific notice or authorization check in this flow. For bedroom and mental-health monitoring footage, general references to API usage do not clearly communicate that local raw recordings leave the device or establish consent to that transfer.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser accepts an export-only option that explicitly promises no analysis, but main never branches on it. With an input supplied, the program still resolves identity and invokes the analysis workflow, potentially disclosing sensitive home-camera recordings contrary to the selected mode.

Content

No source excerpt is available for this finding.

The documented create-only save operation can overwrite existing records.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The documented create operation catches every insertion exception and silently attempts updates by ID, then by username or realname. A conflicting identity can therefore overwrite existing user fields, including authentication tokens, rather than fail safely, creating an integrity risk in shared identity storage.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation and analysis result, but never invokes the agent and returns no result.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The agent invocation is commented out, and accessing result.stderr on an empty dictionary always raises an exception that is swallowed, leaving the caller with None. If the behavioral-monitoring workflow relies on this method, analysis and subsequent health notifications can silently fail; the supplied source does not establish whether that workflow actually calls it.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

The generically named open helper always uses write mode, which immediately truncates an existing file even before anything is written. No docstring, explanatory comment, confirmation, or action log discloses this destructive behavior.

Content

No source excerpt is available for this finding.

The request helper silently registers remote platform accounts, beyond the declared behavioral-analysis purpose.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

When authentication tokens are missing, an ordinary request can initiate a remote login or registration using silent=1 and register=1, transmitting the resolved identity and persisting returned account information. No explicit enrollment approval is visible, creating an unexpected external identity-management side effect in a sensitive home-health monitoring skill.

Content

No source excerpt is available for this finding.

HTTP requests can silently trigger remote account registration and identity transmission.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The helper embeds account creation and identity transmission inside a general HTTP-request operation, so a caller need not explicitly request either side effect. This is the same underlying issue as the registration finding above, and it is especially concerning where users expect processing of private household behavior rather than automatic platform enrollment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The POST sends the resolved username as both openId and mobile, plus a platform-source identifier, to the configured remote health service during automatic enrollment. External communication alone is not a vulnerability, but the visible lack of an enrollment-consent gate makes this identity disclosure problematic; this call does not demonstrate transmission of camera footage or behavioral records.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and files, including during module import.

Low

• Category: Output Handling
• Confidence: 93% confidence

Finding

YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is missing, without any explanatory comment, docstring, or user-facing notice. Because BaseEnum.init_subclass invokes this loader at L053 and L058, defining the configuration classes during import can modify the filesystem unexpectedly.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default