Elderly Drinking-Cup Pickup Frequency (Dehydration Risk) | 老年人饮水杯拿起频率（脱水风险）

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:09 AM UTC
• Version: 1.0.6

Overview

This skill has a coherent elderly drinking-frequency purpose, but it handles sensitive in-home video through cloud APIs and silently creates or reuses persistent backend identity records.

Install only if you are comfortable sending elderly in-home camera footage or video URLs to the LifeEmergence cloud service and storing a reusable local/backend identity for report access. Confirm consent from the monitored person or guardian, limit inputs to footage you own, and review local data/token handling before using history reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while its documented behavior requires shell execution, local file handling, network access, and likely environment/config access. This mismatch is dangerous because it obscures the true privilege footprint from reviewers and users, making it easier to introduce overprivileged behavior without explicit scrutiny.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill's stated purpose is local or URL-based video analysis of cup interactions, but it also mandates cloud historical report queries and report-link retrieval. That expands data flow beyond the minimum necessary purpose and creates unnecessary exposure of sensitive elderly-monitoring data, including behavioral history and cloud-stored report metadata.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically reusing or creating a local default user identity introduces identity management and persistent linkage that is not necessary for one-off drinking-frequency analysis. In a health-monitoring context, this can silently associate sensitive reports with the wrong person or create undisclosed profiles, causing privacy violations and cross-user data leakage.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script’s stated purpose is elderly hydration-risk video analysis, but it forwards work to a generic backend and also exposes a hidden list-retrieval path tied to an internal OpenID context. That mismatch creates an insecure-delegation and unauthorized-data-exposure risk: users may unknowingly invoke functionality outside the advertised scope, including retrieval of prior analysis records unrelated to the supplied video.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The elderly-care tool still exposes pet-oriented parameterization and help text, indicating code reuse without proper hardening or scope cleanup. While this is not direct code execution, it is a security-relevant integrity issue because misleading interface semantics can cause operators to send sensitive elderly-monitoring data to the wrong model path or trust an analysis flow that does not match the declared function.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill accepts arbitrary http/https video URLs and forwards them to the backend analysis service, which expands data intake beyond the manifest's fixed-camera/local monitoring use case. In a health-monitoring context involving elderly people and in-home video, this creates privacy and scope-creep risk because users or calling agents can submit unrelated third-party or internet-hosted footage without any origin restriction, consent check, or domain allowlist.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The report listing/export functionality exposes generic historical analysis retrieval and image-export capabilities that are broader than the narrowly described dehydration-risk workflow. In a home-health video setting, this can increase unauthorized data exposure risk by making prior analysis artifacts easier to enumerate or retrieve if access control is weak elsewhere, especially since this code does not enforce an open_id or other caller binding.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This file exposes a broad, generic HTTP API wrapper with pagination, CRUD-style helpers, and arbitrary URL forwarding that goes well beyond the skill’s declared purpose of local cup-interaction/dehydration analysis. In a privacy-sensitive elderly-monitoring skill, extra network-facing capability increases the attack surface and could be repurposed to access, transmit, or manipulate remote resources unrelated to the stated function.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The add/edit/delete and generic POST/PUT/DELETE helpers provide remote modification capabilities that are not justified by the stated analytics-only use case. Even if intended as reusable infrastructure, these methods could enable unauthorized state changes or data tampering if exposed through higher-level skill logic, which is especially concerning in a monitoring context handling sensitive household/elderly data.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements a persistent user/account store, including identity and account lookup logic, which is unrelated to the stated purpose of counting cup-pickup events from fixed-camera video. In a health-monitoring skill for elderly hydration, collecting and persisting user-account data expands the data surface unnecessarily and creates privacy and security exposure without clear functional justification.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores authentication-related secrets (token, open_token) alongside personal profile data such as username, realname, email, birthday, sex, and age, yet the skill's described function does not require account or token storage. In the context of an elderly-monitoring skill, this is especially sensitive because it combines health-adjacent monitoring with unnecessary identity and credential data, increasing harm if the database is exposed or reused improperly.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This utility file provisions or reuses user identities, reads identity material from workspace storage, and persists default accounts locally, which is unrelated to the declared purpose of local cup-pickup video analysis. In a skill that users would expect to operate on-device with a fixed camera, hidden identity creation and account binding materially expand data handling and can enable silent backend linkage of user activity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The generic HTTP helper can send arbitrary outbound requests, inject identity and platform metadata, and automatically trigger login/registration flows. That behavior is much broader than the skill's stated camera-based hydration proxy function, making the code capable of transmitting behavioral or identity data to external services without clear necessity or informed user expectation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code inspects agent workspace layout, derives root paths from `__file__` and environment state, and creates `data` and `skills` directories. For a skill advertised as video analysis of cup interactions, this broader filesystem and agent-context discovery is not obviously necessary and increases the risk of unintended cross-workspace access, persistence, or installation behavior.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The default trigger activates on generic living-room or kitchen video analysis requests, not narrowly on clear dehydration-monitoring intent. Overbroad triggering can cause the skill to process unrelated household surveillance footage, increasing unnecessary access to sensitive video and the chance of unintended execution paths such as uploads, storage, or cloud queries.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The keyword-based history trigger includes broad phrases like viewing reports or diagnosis-related terms without strong scope checks. This can invoke cloud history retrieval for ambiguous requests and expose sensitive health-related report listings or links beyond the user's intended action.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document describes continuous in-home camera monitoring of an elderly person’s drinking behavior and includes a report export endpoint, but it does not pair these capabilities with explicit privacy, consent, retention, access-control, or data-sharing warnings. In this context, the omission is security-relevant because it normalizes collection and export of highly sensitive behavioral data from a private home environment, increasing the risk of misuse, overcollection, or unauthorized disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool analyzes video through an external service but provides no explicit user-facing notice that local video files or referenced remote video content may be transmitted off-device. In the context of elderly monitoring in private home spaces like kitchens or living rooms, this creates meaningful privacy and consent risk because highly sensitive footage may be uploaded without informed awareness.

Missing User Warnings

Low

• Confidence: 62% confidence
• Finding: The save routine overwrites any target file path without validation, backup, permission hardening, or even error reporting. If an attacker can influence the path argument elsewhere in the application, this can lead to arbitrary file clobbering or destruction of existing configuration, and the silent exception handling makes such misuse difficult to detect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code silently reads an identity value from `data/smyx-api-key.txt` and uses it as an internal open-id source. Because this occurs without user-facing disclosure or confirmation, a local file can implicitly control remote identity association and data attribution in ways the user may not understand.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The helper automatically sends `openId`, `mobile`, and source fields to a remote login/registration endpoint with `silent` and `register` enabled. In the context of an elderly-monitoring hydration skill, this undisclosed identity transmission is especially sensitive because it can link household monitoring activity to backend user records without transparent consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2