Elderly Fall Detection Skill | 老人跌倒检测技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:11 AM UTC
• Version: 1.0.14

Overview

This skill appears to be a cloud fall-detection client, but it handles private home-monitoring media and identity tokens with under-disclosed and insecure behavior.

Install only after confirming the publisher, service operator, HTTPS production endpoints, data retention/deletion policy, and credential-storage model. Users should understand that local home-monitoring images or videos may be uploaded to a remote service and that the skill silently creates or reuses an identity and stores reusable tokens locally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/config-dev.yaml:2
• Finding: Monitoring Media, Identity Data, and Authentication Tokens Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:2-15`, `skills/smyx_common/scripts/config-dev.yaml:1-7`, `skills/smyx_common/scripts/util.py:546-561, 610-646`, `skills/smyx_analysis/scripts/skill.py:122-138` **Vulnerability Type**: Cleartext transmission of sensitive information **Risk Level**: High ### Vulnerable Code `skills/smyx_common/scripts/config.yaml:2-15`: ```yaml ApiEnum: api-key: null api-secret-key: null base-url-health: https://lifeemergence.com/jeecg-boot-xzgz base-url-open-api: https://open.lifeemergence.com/smyx-open-api base-url-open-h5: http://livemonitor.lifeemergence.com database-url: null ConstantEnum: app--id: x1a3s4nwy1s2r4se current--tentant-code: XIAN_ZHAO_GAN_ZHI default--skill-platform-name: ARK_CLAW feishu-app--id: cli_a93d769369badcb1 feishu-app--secret: null is-debug: false env: dev ``` `skills/smyx_common/scripts/config-dev.yaml:1-7`: ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` `skills/smyx_common/scripts/util.py:546-561`: ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") ``` `skills/smyx_common/scripts/util.py:610-646`: ```python headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefau ...[truncated 3703 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `env: dev` from the distributed production configuration and default to a dedicated production profile. 2. Require HTTPS for authentication, analysis, polling, report retrieval, and report export endpoints. 3. Reject non-HTTPS endpoint values at configuration-load time outside explicitly isolated local testing. 4. Apply an allowlist of approved API hostnames so configuration errors cannot redirect credentials or monitoring media to arbitrary hosts. 5. Ensure TLS certificate verification remains enabled and use a controlled trust store where private infrastructure requires an internal certificate authority. 6. Rotate all tokens that may have traversed the plaintext endpoints. 7. Use short-lived, narrowly scoped tokens that cannot access unrelated users or administrative APIs. 8. Add automated release tests that resolve the effective configuration and fail if any sensitive endpoint uses HTTP. 9. Clearly disclose that local monitoring media is uploaded for cloud processing, including the service operator, retention policy, and deletion controls. 10. Consider end-to-end payload encryption for especially sensitive home-monitoring media in addition to TLS. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/dao.py:454
• Finding: Reusable Authentication Tokens Persisted Unencrypted in a Predictable Shared SQLite Database<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/dao.py:172-180, 454-462`, `skills/smyx_common/scripts/util.py:586-605` **Vulnerability Type**: Insecure storage of authentication credentials **Risk Level**: Medium ### Vulnerable Code `skills/smyx_common/scripts/dao.py:172-180`: ```python if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) ``` `skills/smyx_common/scripts/dao.py:454-462`: ```python username = Column(String(100), unique=True, index=True, nullable=False) realname = Column(String(200), unique=True, index=True) email = Column(String(45), unique=True, index=True) birthday = Column(DateTime, unique=True, index=True) sex = Column(Integer) age = Column(Integer) token = Column(String(500)) open_token = Column(String(1000)) source = Column(String(50)) ``` `skills/smyx_common/scripts/util.py:586-605`: ```python if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken" ) user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` ### Technical Analysis The Skill stores the access token and open authorization token directly in ordinary SQLite text columns. The database uses a fixed filename, `smyx-common-claw.db`, in the shared workspace data area. ...[truncated 1881 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not persist access or authorization tokens unless persistence is strictly required. 2. Persist only a non-secret identity reference and obtain a new short-lived token when each operation starts. 3. If token persistence is unavoidable, use an operating-system-backed credential store rather than SQLite text columns. 4. Where no credential store is available, encrypt tokens with an authenticated encryption scheme whose key is stored separately and protected by the operating system. 5. Create the database and its parent directory with owner-only permissions, and explicitly verify permissions rather than relying on the process umask. 6. Avoid sharing credential databases between unrelated Skills or users. 7. Implement short token lifetimes, narrow API scopes, rotation, revocation, and replay monitoring. 8. Exclude the database from backups, diagnostics, archives, and logs unless those systems provide equivalent secret protection. 9. Migrate existing installations by revoking stored credentials, deleting plaintext token columns, and issuing replacement credentials through the hardened flow. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding combines filesystem writes, local credential-file reads, identity creation/persistence, external login/registration requests, and token handling under the guise of a fall-detection skill. That is particularly dangerous because it mixes sensitive credential and account-management behaviors with private home-monitoring uploads, creating a broad and opaque data-access surface.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "elderly-fall-detection-analysis"
description: "Utilizes vision and radar technology for contactless detection of falls. It triggers alarms within seconds and is suitable for home safety monitoring of elderly people living alone. | 老人跌倒检测技能，视觉/雷达无感识别摔倒倒地，秒级触发报警，适用于独居老人居家安全监测场景"
version: "1.0.16"
license: "MIT-0"
---

# 🧓 Elderly Fall Detection Skill | 老人跌倒检测技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

---

## 🧭 技能概览 | Overview

| 模块 | 内容 |
|---

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The add, edit, delete, and generic http_post/http_put/http_get/http_delete methods allow arbitrary remote resource access and modification based on caller-supplied URLs and arguments. In the context of a fall-detection skill, this capability is unjustified and dangerous because it can be repurposed to exfiltrate data, alter remote state, or interact with unintended internal or external services if any upstream component can influence the URL or payload.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code automatically resolves or creates user identities, logs into a remote service, retrieves tokens, and persists them locally, even when the caller did not explicitly provide credentials. That is dangerous because it enables undisclosed account provisioning and long-lived token storage unrelated to the stated fall-detection purpose, expanding both privacy and account-abuse risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no explicit tool restrictions while its documented workflow requires shell execution, filesystem access, network access, and implicit handling of local identity/config state. In an agent environment, missing scope declarations widen the effective authority of the skill and make accidental or unsafe invocation more likely.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill says it 'defaults' to triggering whenever a user provides monitoring images/videos needing fall detection, but it does not clearly distinguish this from other video-analysis tasks or define non-matching cases. This creates ambiguity around when the skill should activate versus when a more general analysis skill should handle the request.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The auto-trigger list includes broad phrases like “检测报告列表” and “显示所有跌倒报告,” which lack strong context boundaries and could overlap with ordinary requests to view reports. The description does not provide exclusion conditions or negative examples to clarify when the history-query function should not activate.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script accepts a hidden --open-id parameter and initializes identity via OpenIdUtil.resolve_current_open_id(...) without clear user-facing disclosure. Hidden identity selection can enable analysis or retrieval of another user's records when combined with the --list path, creating an authorization/privacy risk, especially in a fall-detection context that handles sensitive monitoring data about elderly individuals.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill returns fixed Chinese-language strings such as the report header and export-link text, and similar hard-coded Chinese messages appear elsewhere in the file. This is a natural-language policy concern because the skill imposes a specific locale/language choice without offering the user an option or documenting a justified regional constraint.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill reads an arbitrary local file path, loads the full file into memory, and submits its contents to a remote analysis service via the `files` parameter. There is no user-facing notice, confirmation, or consent mechanism in this code path, so sensitive local media may be exfiltrated unexpectedly. In a home monitoring context, uploaded videos are especially privacy-sensitive because they may contain elderly persons inside private residences.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a skill for contactless elderly fall detection using vision/radar, triggering alarms for home safety monitoring. In this file, the exposed functions and CLI only perform generic 'video analysis' and listing of analysis history via skill.get_output_analysis / get_output_analysis_list, with no fall-specific logic, alarm behavior, radar handling, or elderly-monitoring semantics evident in the documented interface.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script accepts a hidden `--api-key` argument and forwards externally supplied video paths/URLs for remote analysis, but provides no user-facing notice about secret handling, logging exposure, or transport guarantees. Suppressing the parameter from help can increase operational risk because users and integrators may pass credentials insecurely via process arguments, which are often visible to other local users, shell history, or monitoring tools.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2