Elderly Bed-Exit & Wandering Monitor | 老人离床徘徊监测技能

• Outcome: Review
• Latest audit: Oct 14, 2026 · 9:26 PM UTC
• Version: 1.0.20

Overview

This appears to be a real cloud-backed eldercare video analysis skill, but it needs review because it handles sensitive footage, history reports, and identity tokens with limited user-facing disclosure.

Install only if you are comfortable with eldercare images or videos and historical reports being processed by the configured LifeEmergence cloud services. Confirm consent from monitored people, avoid sensitive footage unless necessary, do not use untrusted video URLs, and treat the local workspace data directory as sensitive because it may contain identity and token data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding states the skill performs outbound HTTP requests, handles auth tokens, reads/writes local files, manages workspace paths, and may auto-create or retrieve user identities, yet contains no visible night-monitoring or anomaly-detection logic. In the context of elderly monitoring media, this is especially dangerous because highly sensitive video could be transmitted and associated with user identities under misleading functionality claims.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "elderly-bed-exit-wandering-monitoring-analysis"
description: "Identifies abnormal behaviors such as getting out of bed at night, prolonged wandering, and remaining motionless for extended periods. It is suitable for night-time safety monitoring in nursing homes and for elderly people living alone. | 老人离床徘徊监测技能，识别夜间起床离床、长时间徘徊、长时间静止不动异常行为，适用于养老院、独居老人夜间安全监测"
version: "1.0.13"
license: "MIT-0"
---

# 🛏️ Elderly Bed-Exit & Wandering Monitor | 老人离床徘徊监测技能
> **智能分析中枢** · 图片/视频智能分析 · 结

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles monitoring images/videos and directs use of cloud APIs, but the description does not clearly warn users that sensitive eldercare footage may be transmitted off-device and processed remotely. For surveillance involving potentially vulnerable adults, lack of explicit privacy and transmission disclosure creates substantial consent, compliance, and confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The User model stores authentication-like secrets (token, open_token) alongside PII such as username, realname, email, birthday, sex, and age, with no visible encryption, hashing, access control, or purpose justification for a safety-monitoring skill. If this SQLite database is read or copied, it could expose both personal data and reusable credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and operationalizes powerful capabilities such as shell execution, network access, file read/write, and environment usage, but it does not declare any explicit tool scope or permission boundaries. In an agent setting this weakens reviewability and containment, making it easier for the skill to invoke sensitive actions beyond what a user would reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The history-report trigger phrases are broad enough that ordinary user language may unintentionally invoke cloud report-listing behavior. In a sensitive monitoring context, accidental retrieval of prior reports can expose private surveillance or health-related records without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code accepts video input from a local path or network URL and analyzes elderly bed-exit/wandering behavior, which likely involves sensitive personal footage. Although the script prints progress and save notices, it does not disclose privacy implications, data handling, or whether content may be transmitted or retained during analysis.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Several returned user-facing strings are fixed in Chinese, such as the report header and export-link text. The file provides no indication that users can select a language or opt into this locale, which violates the requirement to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The no-results message is returned only in Chinese, with no mechanism for language negotiation or user preference. This creates a forced locale experience rather than offering a language choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill accepts arbitrary HTTP/HTTPS URLs and forwards them to a backend analysis service, which expands the trust boundary from local user-provided files to attacker-controlled remote resources. In a monitoring skill handling elderly-care video, this can enable unauthorized external content ingestion, privacy issues, and potential server-side fetching risks if the backend retrieves internal or sensitive URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code reads local video files into memory or forwards remote video URLs to an external analysis service without any visible user-facing disclosure, confirmation, or minimization controls. Because this skill is for elderly safety monitoring, the content is likely highly sensitive surveillance footage, making silent transfer to a backend a significant privacy and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill exposes a listing function for historical analysis records, which broadens capability from single-item analysis to retrieval of prior reports. In a healthcare/elderly monitoring context, historical report metadata and embedded results may contain sensitive behavioral or health-related information, increasing privacy and data exposure risk if access control is weak or callers are not properly scoped.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The analysis-list heading and empty-state message are fixed in Chinese. No opt-in, locale configuration, or region-specific justification is present in this file, so the skill appears to enforce a specific language.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2