Elderly Drinking-Cup Pickup Frequency (Dehydration Risk) | 老年人饮水杯拿起频率（脱水风险）

• Outcome: Review
• Latest audit: Oct 27, 2026 · 5:02 AM UTC
• Version: 1.0.14

Overview

This cloud video-analysis skill needs review because its export-only option still runs analysis and its credential handling lacks destination safeguards.

Before installing, ask the publisher to fix export-only behavior and restrict authenticated requests to approved HTTPS destinations. Confirm remote account creation, credential protection, and video/report retention and deletion controls. Use only footage whose subjects have given informed consent, and treat cup counts as an indirect estimate rather than a medical assessment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Database persistence could legitimately support daily event counting, so CRUD and filesystem operations alone are not a mismatch. However, the concrete model and specialized queries here manage user identities and authentication-related data, rather than cup events or hydration thresholds. The supplied chunk contains no video analysis, contact detection, daily pickup aggregation, or dehydration-alert logic. It may be a shared dependency of a larger system, but its demonstrated account-management capability is not represented by the declared purpose. No network transmission or actual token collection is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The reported attachment of API keys and access tokens to caller-supplied absolute URLs creates a credential-disclosure path if an attacker can influence the destination. Compromised credentials could expose sensitive household videos and health-related reports; automatic identity setup is documented, but does not justify sending credentials to arbitrary origins, and the reported implementation requires source verification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The visible implementation does not implement the declared primary purpose. Although comments describe invoking an external agent, that invocation is disabled and should not be treated as an active capability. Imported base classes may provide additional behavior, but their implementations are unavailable, so this assessment is limited to the supplied chunk. No active undeclared command execution or data exfiltration is evident.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

HTTP utilities and pagination could support the declared application and are not inherently mismatches. However, the supplied code also exposes account lookup and general remote data-management and download-link capabilities with no demonstrated connection to cup monitoring. Those capabilities are not represented in the description. This assessment is limited to the supplied chunk; it does not establish that these methods are invoked or that the broader application lacks the declared monitoring functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence

Finding

The supplied code exposes general analysis submission and report-management functions rather than the declared cup-monitoring workflow. Uploading video and polling a remote service could be supporting implementation details, so those operations alone are not mismatches. However, report-history retrieval expands the declared functionality, and nothing in this chunk ties requests or results to cup interactions, daily counts, or dehydration thresholds. The remote service implementation is not supplied, so it remains possible that some declared behavior occurs there; this assessment is limited to the visible code.

Content

No source excerpt is available for this finding.

The request helper can forward service credentials and user identity to arbitrary HTTP destinations.

High

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The helper accepts arbitrary absolute HTTP or HTTPS URLs and automatically attaches service tokens, the API key, and user identity without checking the destination. A caller-controlled or misconfigured destination can therefore receive credentials, and plain HTTP can expose them to network observers; compromise could extend beyond the drinking-frequency workflow.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Activation rules can select dehydration analysis for unrelated video-analysis requests.

Medium

• Category: Trigger Abuse
• Confidence: 93% confidence

Finding

L064 defaults to this skill whenever a user requests analysis of living-room or kitchen cup-area footage, without requiring an intent to assess drinking frequency. L065 also accepts broad topics such as elderly care, constipation, or cognitive impairment alongside any uploaded video, which could incorrectly activate this skill for fall monitoring or other unrelated analyses.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises not to perform analysis, but its parsed value is never checked; when --input or --url is supplied, execution still reaches skill.get_output_analysis. A user relying on this mode could unintentionally trigger processing of private household video involving an elderly person, potentially including transmission if the downstream implementation uses a remote service, although that implementation is not shown.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are submitted to the analysis API without disclosure of the upload.

Medium

• Category: Output Handling
• Confidence: 89% confidence

Finding

The code reads the entire local video and passes its contents to the analysis API without a visible upload disclosure or consent check. In-home recordings of elderly people can expose sensitive activities and health-related information, making undisclosed transfer a meaningful privacy risk even though video analysis is the intended function. The API implementation is not provided, so its destination, transport security, and retention practices cannot be verified.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises not to execute analysis, but its parsed value is never checked; supplying it with --input or --url still invokes skill.get_output_analysis(). This violates the user's explicit no-analysis selection and can trigger unintended processing, API requests, or associated costs, depending on the downstream implementation. The elderly-monitoring context increases the privacy consequences because the input can contain sensitive household footage and health-related information.

Content

No source excerpt is available for this finding.

The service exposes general-purpose remote modification and deletion capabilities unrelated to drinking-frequency analysis.

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The http_put and http_delete methods forward caller-supplied URLs and arguments to HTTP request utilities (L077–L095). Modifying or deleting arbitrary remote resources is not a direct requirement of detecting cup pickups, counting daily events, or producing dehydration-risk reminders, and the manifest does not declare this broader capability.

Content

No source excerpt is available for this finding.

The DAO implements persistent user-profile and credential management unrelated to cup-pickup analysis.

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The User model stores email, birthday, demographic information, token, and open_token, and UserDao exposes inherited CRUD operations over those records. DAO initialization also creates and migrates the user table (L180–L215). Managing identity credentials and detailed user profiles is not justified by the manifest's stated purpose of counting cup pickups and producing dehydration-risk reminders; this file does not establish that any credentials are actually populated.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation but never executes it or returns an analysis result.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The agent invocation is commented out, and accessing result.stderr on an empty dictionary raises an AttributeError that is caught and suppressed, causing ai_chat to return None without analysis. If the drinking-frequency monitoring workflow relies on this method, silent failure could prevent dehydration-risk alerts or make unavailable analysis appear to be normal operation. This is an availability and safety-relevant failure, not evidence of malicious behavior; the supplied file does not establish whether the monitoring workflow actually calls this method.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

Opening a path with mode 'w' immediately erases any existing contents, even before the caller writes anything. This generically named helper has no confirmation, user-facing notice, docstring, or comment explaining that behavior; exception tracing does not disclose successful truncation.

Content

No source excerpt is available for this finding.

HTTP requests can silently register a remote account and persist its credentials, beyond the declared drinking-frequency analysis.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

When tokens are missing, an ordinary HTTP request can trigger remote login or registration with 'silent' and 'register' enabled, then persist the returned credentials through UserDao. No explicit enrollment authorization is visible in this flow; silently creating a remotely linked identity is a privacy concern for an elderly-monitoring skill, although the surrounding application's consent and storage protections are unknown.

Content

No source excerpt is available for this finding.

The HTTP helper silently initiates remote login or registration using the current user identifier.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The request helper embeds silent remote enrollment as an implicit authentication side effect, sending the current identifier as both 'openId' and 'mobile'. This duplicates the enrollment issue in SDI-1 rather than constituting a separate exploit, but the hidden identity disclosure is relevant to a privacy-sensitive home-monitoring skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This POST transmits the current user identifier to a remote account service as part of automatic login or registration, without an authorization check visible in this path. External requests alone are not vulnerabilities, and there is no evidence here of video transmission or a malicious destination; the confirmed concern is the same implicit identity disclosure described in SDI-1.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and writes a file when the requested configuration is missing (L017–L020).

Low

• Category: Output Handling
• Confidence: 93% confidence

Finding

YamlUtil.load performs filesystem writes without a confirmation, log message, docstring, or explanatory comment disclosing this side effect. BaseEnum.init_subclass invokes this loader during class creation (L052–L058), so importing the module can create configuration files without an explicit save request.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()