ClawHub
Back to skill

Security audit

Elderly Bed-Exit & Wandering Monitor | 老人离床徘徊监测技能

Security checks across malware telemetry and agentic risk

Overview

This skill’s cloud video analysis purpose is understandable, but it silently creates and reuses identities, stores tokens locally, and sends sensitive monitoring data to external services with weak user-facing consent boundaries.

Review before installing. Use only with explicit authorization from the monitored person or responsible caregiver, and assume local videos, video URLs, identifiers, and report history may be sent to lifeemergence.com services. Do not install in a healthcare, nursing-home, or family-monitoring environment unless you accept the automatic account creation, local token storage, and cloud retention implications.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
Here, filter keys are taken from the caller-supplied filters dictionary and passed into getattr(self.__model__, key) without validation. While SQLAlchemy prevents classic SQL injection here, an attacker or misuse by other code can query arbitrary model attributes, trigger unexpected exceptions, or bypass intended field-level restrictions by filtering on sensitive/internal columns.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
The count() method accepts arbitrary filter keys and resolves them dynamically on the model. This can expose internal schema details, enable unauthorized filtering on sensitive columns, and cause denial-of-service style errors if unexpected attributes are requested repeatedly.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to read and write local files, invoke Python modules, access network resources, and query a cloud API, yet it declares no explicit permissions or trust boundaries. This creates a capability mismatch that can lead to unintended execution or data access without clear user consent, especially given the sensitive nature of uploaded monitoring videos and report data.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The CLI includes a function to list previously analyzed records by user identity, which expands the skill from local/video monitoring into retrieval of historical user-linked data. In a safety-monitoring context involving elderly subjects, this creates privacy and access-control risk because behavior records may be sensitive and the code shown does not enforce authorization checks before exposing them.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code resolves an internal open_id even though the advertised functionality is behavior analysis of a provided video or URL. Tying analysis actions to an internal identity without a clear need increases the risk of covert user tracking, cross-user data association, or unauthorized access to sensitive monitoring results, especially given the elderly-care surveillance context.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This file exposes broad generic CRUD and arbitrary HTTP helper methods that are not scoped to the stated elderly monitoring purpose. In a skill intended for safety monitoring, unrestricted request wrappers can be repurposed to access or modify unrelated backend resources, expanding the attack surface and enabling capability abuse if other components can influence the URL or payload.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The user account lookup helper provides identity-related access that is not justified by the declared bed-exit and wandering monitoring function. Even if intended for convenience, exposing username-based lookup increases privacy risk and can support user enumeration or unauthorized correlation of monitoring data with accounts.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is described as elderly bed-exit and wandering monitoring, but this file implements a reusable user-account DAO with identity fields and account lookup/update logic. That scope mismatch increases the chance of unnecessary collection and persistence of personal data, expanding the attack surface beyond what users would reasonably expect from a safety-monitoring skill.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The model stores token and open_token fields even though the advertised function is behavioral safety monitoring. Persisting authentication-like secrets in a local SQLite database materially raises risk of credential theft, impersonation, or unauthorized API access if the file is read, copied, or backed up insecurely.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This utility file embeds broad backend API authentication, token handling, and account-management behavior that is unrelated to an elderly wandering/bed-exit monitoring skill. The mismatch in scope increases risk because installing a seemingly safety-focused skill also grants it capability to contact external services, manage identities, and persist auth state, which expands attack surface and can surprise users.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The request path can automatically register or create backend user identities via /sys/phoneLogin with register enabled, then store returned tokens for later use. For a safety-monitoring analysis skill, silent identity provisioning is unjustified and dangerous because it can create unauthorized accounts, link activity to fabricated identities, and transmit user identifiers to a remote service without explicit consent.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code reads identity material from a workspace file, falls back to local database records, and may create and persist a default open-id for future reuse. Persistent identity handling beyond the skill's stated monitoring purpose creates privacy and accountability risks, especially in a healthcare-adjacent context where operators may not expect local tracking identities to be created and retained automatically.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default trigger is broad enough that ordinary mentions of nighttime monitoring or elderly behavior analysis could invoke the skill automatically, even when the user did not clearly intend cloud-backed video processing. Over-broad invocation is risky here because the workflow includes automatic file handling and external API use on potentially sensitive surveillance footage.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill says uploaded attachments are automatically saved locally and that network URLs or report queries are handled via an API, but it does not prominently warn users that sensitive elderly monitoring videos and related report metadata may be transmitted to cloud services. For health-adjacent surveillance use cases, this omission creates significant privacy and compliance risk because users may unknowingly expose highly sensitive personal data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This code accepts either a local file path or a remote video URL and forwards the content to an external analysis API, but the code shown provides no user-facing disclosure, confirmation, or consent mechanism before transmitting potentially sensitive surveillance footage. In the context of elderly bed-exit and wandering monitoring, the uploaded data is especially privacy-sensitive because it may contain identifiable health, location, and behavioral information about vulnerable individuals.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script defines a hidden --api-key argument and performs remote video analysis and history retrieval without clear user-facing disclosure about credential use or data transmission. In this skill's context, the analyzed content may contain sensitive elderly-monitoring footage and identifiers, so undisclosed remote handling materially increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The helper performs outbound HTTP requests without any visible disclosure, consent, or contextual warning in this file. In a monitoring skill handling sensitive elderly safety data, silent network transmission increases the risk of unnoticed exfiltration of identifiers, telemetry, or device-related information to backend services.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debugging are turned on globally, which can expose full request and response contents, including sensitive headers, tokens, identifiers, and API payloads, in logs. In a monitoring skill that may process sensitive resident-related data, such logging materially increases confidentiality risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code can generate a default user identifier and save it into the local database automatically, without any user-facing notice or consent flow. Silent creation of persistent identities is risky because it obscures data ownership, enables covert tracking across sessions, and is especially inappropriate in an elderly safety-monitoring context where privacy expectations are high.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This request flow sends usernames/open IDs and authentication tokens to external services and also injects identifying metadata such as tenant and platform values, without any visible user-facing warning in the skill. In a healthcare-adjacent monitoring deployment, undisclosed transmission of identity and auth material is more dangerous because it may involve sensitive operational or resident-linked data.

Missing User Warnings

Low
Confidence
80% confidence
Finding
Reading an internal identity value from a local API-key-related file without clear disclosure is a privacy/transparency concern, even if it is not by itself a strong technical exploit. In context, it contributes to a pattern of silent identity acquisition that users of a monitoring skill would not reasonably expect.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
90% confidence
Finding
This code performs an external POST to a backend login/registration endpoint, transmitting openId/mobile/source data. External transmission is especially concerning here because the skill's stated purpose is local elderly safety monitoring, so silent outbound identity-related traffic is unexpected and increases privacy, compliance, and abuse risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2