Elderly Drinking-Cup Pickup Frequency (Dehydration Risk) | 老年人饮水杯拿起频率（脱水风险）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 1.0.10

Overview

This skill is a review case because it handles private elder-care video and identity tokens while defaulting to development/plaintext network endpoints and silent local identity persistence.

Install only after the publisher removes development HTTP endpoints, requires HTTPS and trusted hostnames, documents where uploaded videos and reports are stored, gives users clear control over identity/report history, and fixes the dependency name. Treat this as sensitive because it can upload private household video and persist account tokens.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/config.yaml:2
• Finding: Private video, identity data, and authentication tokens are transmitted over plaintext HTTP## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:2-15`, `skills/smyx_common/scripts/config-dev.yaml:1-7`, `skills/smyx_analysis/scripts/skill.py:113-132`, and `skills/smyx_common/scripts/util.py:551-565, 572-612, 646-657` **Vulnerability Type**: Plaintext transmission of sensitive information and insecure development configuration **Risk Level**: High ### Vulnerable Code `skills/smyx_common/scripts/config.yaml:2-15`: ```yaml ApiEnum: api-key: null api-secret-key: null base-url-health: https://lifeemergence.com/jeecg-boot-xzgz base-url-open-api: https://open.lifeemergence.com/smyx-open-api base-url-open-h5: http://livemonitor.lifeemergence.com database-url: null ConstantEnum: app--id: x1a3s4nwy1s2r4se current--tentant-code: XIAN_ZHAO_GAN_ZHI default--skill-platform-name: ARK_CLAW feishu-app--id: cli_a93d769369badcb1 feishu-app--secret: null is-debug: false env: dev ``` `skills/smyx_common/scripts/config-dev.yaml:1-7`: ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` `skills/smyx_analysis/scripts/skill.py:113-132`: ```python if (input_path.startswith("http://") or input_path.startswith("https://")): params.update({ "videoUrl": input_path }) else: _validate_file(input_path) # Automatically detect the MIME type mime_type, _ = mimetypes.guess_type(input_path) if mime_type is None: mime_type = 'application/octet-stream' # Read the file contents with open(input_path, 'rb') as f: file_content = f.read() files = { 'file': (os.path.basename(input_path), file_content, mime_type) } ``` `skills/smyx_common/scripts/util.py:551-565`: ```python def _get_or_cr ...[truncated 5957 chars]
• Remediation: ## Remediation Suggestions 1. Remove `env: dev` from the release configuration and make production HTTPS endpoints the secure default. 2. Exclude private development configurations from distributed Skill packages. 3. Reject all non-HTTPS API endpoints at startup. Do not silently accept HTTP merely because a URL has an HTTP scheme. 4. Enforce an explicit allowlist of trusted API hostnames and reject private, loopback, link-local, and unexpected IP-literal destinations in production. 5. Retain the default TLS certificate and hostname verification performed by `requests`; do not add verification bypasses. 6. Require explicit administrator configuration before changing service destinations, and display the destination hostname before sensitive uploads. 7. Avoid duplicating the internal identity into a field named `mobile` unless the server contract strictly requires it and its privacy implications are documented. 8. Minimize token lifetime and scope, encrypt locally cached tokens where feasible, and rotate any credentials previously transmitted through the HTTP development endpoints. 9. Add automated tests that fail the release build if active configuration contains `http://`, private addresses, development environments, or debug mode. 10. Obtain informed consent before uploading household surveillance footage and document server-side retention, access control, and deletion policies.

T08 · Insecure Dependencies

Warning

• Location: skills/smyx_analysis/requirements.txt:1
• Finding: Incorrect dependency distribution name creates dependency-confusion risk## Vulnerability Details **File Location**: `skills/smyx_analysis/requirements.txt:1-3` **Vulnerability Type**: Dependency confusion caused by an incorrect package distribution name **Risk Level**: Medium ### Vulnerable Code `skills/smyx_analysis/requirements.txt:1-3`: ```text pydash==8.0.6 SQLAlchemy==2.0.46 yaml==6.0.3 ``` The related common requirements file identifies the expected distribution differently in `skills/smyx_common/requirements.txt:1-3`: ```text pydash==8.0.6 SQLAlchemy==2.0.46 PyYAML==6.0.3 ``` The source imports the module supplied by PyYAML in `skills/smyx_common/scripts/config.py:8`: ```python import yaml ``` ### Technical Analysis Python distribution names and import-module names are not necessarily identical. The `yaml` import used by this project is conventionally supplied by the `PyYAML` distribution. The common requirements file correctly specifies `PyYAML==6.0.3`, while the analysis requirements file instead requests a distribution named `yaml==6.0.3`. This inconsistency can cause installation failure or cause a package manager using an affected public or private package index to resolve an unintended distribution. Python packages can execute build-backend or setup logic during installation, so resolving an attacker-controlled package can lead to code execution in the installation context. The audit did not confirm that a malicious package is currently resolved from a particular index. The confirmed defect is the incorrect and inconsistent dependency declaration, which creates a credible supply-chain exposure. ### Attack Path 1. A user or deployment system installs `skills/smyx_analysis/requirements.txt`. 2. The package manager requests the distribution named `yaml` rather than `PyYAML`. 3. A configured package index supplies an unintended or attacker-controlled distribution matching that name and version. 4. The package manager downloads the distribution. 5. Mali ...[truncated 784 chars]
• Remediation: ## Remediation Suggestions 1. Replace `yaml==6.0.3` with `PyYAML==6.0.3`. 2. Consolidate duplicate dependency declarations into one authoritative requirements or lock file. 3. Generate a reproducible lock file containing exact versions and cryptographic hashes. 4. Install dependencies with hash verification, such as `pip install --require-hashes`. 5. Restrict installation to approved package indexes and disable untrusted fallback indexes. 6. Add dependency-name validation and supply-chain scanning to CI. 7. Perform installation as an unprivileged account in an isolated virtual environment or container.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: External HTTP communication combined with account lookup/creation, token management, filesystem access, local persistence, and environment detection forms a much broader operational footprint than the declared analysis task. In context, this is dangerous because the skill handles private household video of elderly individuals and could correlate, store, or exfiltrate associated personal data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Implicit identity initialization, reuse, or auto-creation is not justified by simple hydration monitoring and can silently bind sensitive reports to persistent user records. In a home elder-care context, that creates serious privacy and consent issues because individuals may be tracked or linked without being clearly informed.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores identity and authentication-related fields such as email, token, and open_token, but the declared skill purpose does not justify collecting or retaining such sensitive data. In a home-monitoring context involving elderly users, unnecessary storage of tokens and identity data materially raises privacy and account-compromise risk if the local database is accessed by another skill, user, or attacker.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code inspects workspace paths and environment variables, reads identity material from local files, and creates or reuses default local users without user awareness. For a fixed-camera hydration-monitoring skill, silent identity discovery and persistence are out of scope and create privacy, impersonation, and unauthorized account-association risks.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs broad external HTTP communication, token handling, local user lookup, and automatic account provisioning that are unrelated to the declared local elderly hydration-monitoring purpose. In this skill context, hidden networked identity and account behavior materially expands the attack surface and creates undisclosed data-flow and remote-dependency risks.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit tool restrictions even though the documented behavior requires shell, network, filesystem, and environment access. In a skill that processes sensitive home video and health-related data, missing scope boundaries increases the chance of unintended capability use or abuse and makes review and sandboxing harder.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: A default trigger that activates on essentially any living-room/kitchen video URL or file is overly broad for a privacy-sensitive analysis skill. This can cause accidental invocation on unrelated household footage, resulting in unnecessary upload, processing, or retention of personal video.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Broad keyword triggers around health, caregiving, dehydration, and elderly care can activate the skill in contexts far outside the narrowly described use case. This raises the chance of unintended handling of sensitive medical-adjacent conversations or media without sufficient user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Cloud history-report querying and report-link retrieval extend the skill from single-run video analysis into longitudinal data access. That broadening matters because historical health-adjacent reports can reveal patterns about an elderly person's behavior and condition, increasing privacy impact if accessed improperly.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The string returned at L17 is a fixed Chinese title, which imposes a specific language on all users. The file does not provide any opt-in, locale selection, or justification that this skill is region-specific, so it conflicts with the language/locale policy criteria.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes a narrowly scoped elderly hydration-monitoring skill using fixed-camera cup interaction analysis. However, the code accepts a `pet_type` argument, mutates `ConstantEnum.DEFAULT__PET_TYPE`, and exposes CLI choices `cat`, `dog`, and `other`, which indicates reused animal-analysis behavior inconsistent with the stated purpose.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The parser description and help strings present this tool as an elderly hydration-risk analyzer, but adjacent argument definitions still document and enable `cat`, `dog`, and `other` categories. This is an active contradiction between the user-facing documentation and the actual configurable behavior exposed by the code.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill accepts arbitrary remote video URLs and forwards them to the backend analysis service, which expands the scope beyond the manifest's fixed-camera/local monitoring purpose. This can enable analysis of unrelated third-party or sensitive video sources and creates a capability mismatch that may facilitate privacy abuse or backend misuse.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2