Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because private-footage uploads and stored account credentials lack clear user controls, while its continuous monitoring and emergency-alarm promises are unsupported by the bundled workflow.
Before using private footage, obtain clear upload, retention, deletion, and account-control information from the publisher. Avoid shared workspace identities and do not rely on --export-env-only to prevent uploads. Treat this as on-demand remote analysis until continuous monitoring and emergency notifications are demonstrated.
The visible implementation does not substantiate the declared fall-detection purpose. It provides generic class scaffolding and an incomplete chat helper, with no active external command execution. Imported base classes and API services are not supplied, so their behavior cannot be assessed; this finding is limited to the provided chunk.
The supplied chunk contains no vision/radar processing, fall classification, sensor monitoring, or alarm implementation. Generic helpers alone would not establish a mismatch, but automatic account provisioning, identity-file access, and persistent authentication introduce substantial account-management behavior not represented in the description. This assessment is limited to the supplied module: other files could implement the advertised detection functionality, and the code shown does not establish malicious intent.
The skill promises continuous, radar-assisted protection and alarms within seconds, while the supplied workflow submits individual media inputs and retrieves reports without a demonstrated monitoring or alarm-delivery path. A remote backend could perform fall inference, but these broader guarantees remain unsupported and could cause caregivers to rely on protection that is not operating; historical report retrieval itself is explicitly documented.
The supplied code's substantive functionality is general database and user-account management, rather than fall detection or alerting. Database persistence can support a monitoring system, but this chunk specifically manages identities, personal details, and tokens without a demonstrated connection to the declared functionality. This assessment is limited to the supplied chunk; it does not establish what other skill components implement or indicate malicious behavior.
The visible execution path performs on-demand API analysis, not demonstrated continuous monitoring with rapid alarm delivery. Although server-side fall detection is possible, presenting this client as an always-on safety system creates a dangerous reliance risk for elderly people living alone.
Generic AI-analysis endpoints could support fall detection and are not inherently a mismatch. However, the health-order report export endpoint introduces an unrelated resource not represented in the description. This assessment is limited to configuration: the supplied chunk does not actually make network requests or export reports. The absence of detection and alarm logic alone would not establish a mismatch in a configuration-only file.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "elderly-fall-detection-analysis"
description: "Utilizes vision and radar technology for contactless detection of falls. It triggers alarms within seconds and is suitable for home safety monitoring of elderly people living alone. | 老人跌倒检测技能，视觉/雷达无感识别摔倒倒地，秒级触发报警，适用于独居老人居家安全监测场景"
version: "1.0.22"
license: "MIT-0"
---
# 🧓 Elderly Fall Detection Skill | 老人跌倒检测技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询
---
## 🧭 技能概览 | Overview
| 模块 | 内容 |
|---
The workflow does not clearly warn that local home-monitoring media will leave the device, despite claiming privacy preservation and recommending cameras in bedrooms and bathrooms. API references alone do not explain the transfer and retention implications, creating a substantial risk of uninformed disclosure of intimate footage.
Without declared permissions the skill's intent is opaque and cannot be validated.
The parser accepts --export-env-only and promises no analysis, but execution never checks that flag and proceeds with identity initialization and, when an input is supplied, analysis. A user expecting a non-executing configuration operation could instead cause sensitive home-monitoring footage to be uploaded.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The code reads the entire local media file and passes its bytes to the analysis API without an upload-consent check or clear transfer notice in this path. For footage of elderly people inside private homes, unintended remote disclosure can expose intimate activity and health-related information.
The --export-env-only option is parsed but never used to stop execution, so supplying media alongside it still invokes analysis. This violates an explicit no-analysis guarantee and can cause an unexpected upload of sensitive home footage.
A method documented as creating a record catches every insertion exception and attempts to overwrite an existing record by ID, then by username or realname. If incoming model data is untrusted or incorrectly associated, this can replace another user's identity fields and authentication tokens; such identity corruption is particularly concerning in a safety-monitoring service.
The docstring at L26 explicitly promises to call the openclaw agent through subprocess, and L33–L34 describe returning an analysis result or session ID. However, the command and subprocess invocation are commented out (L48–L66); the code instead creates an empty dictionary at L68 and accesses its nonexistent stderr attribute at L70, causing an exception that is caught and suppressed. The method therefore returns None without performing the documented analysis, which could mislead callers relying on that analysis in a safety-monitoring workflow.
Opening a path with mode 'w' immediately erases any existing contents. This generically named helper has no docstring, comment, confirmation, or user-facing message explaining that destructive behavior; its exception handler does not disclose successful truncation.
An ordinary HTTP operation can automatically invoke registration and pass returned identity information and authentication tokens to local persistence without a separate provisioning decision. Backend authentication may legitimately support fall monitoring, but implicitly creating accounts and retaining credentials introduces privacy and credential-lifecycle risks not explained by the declared functionality.
When credentials are missing, the wrapper sends a separate login or registration request containing the resolved identity as both openId and mobile. That identity can originate from API_SECRET_KEY, so the side request may also disclose a credential as ordinary account data; fall-detection functionality does not itself justify this implicit identity transmission.
This POST is the transmission sink for the implicit identity-provisioning flow, including the possible use of API_SECRET_KEY as the transmitted identity. The configured destination is not visible here, so malicious exfiltration cannot be established, but the unapproved identity or secret disclosure risk remains.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
YamlUtil.load creates parent directories and writes a configuration file when the requested path does not exist, without a disclosure comment, docstring, prompt, or log. Because BaseEnum.init_subclass invokes this loader when the configuration classes are defined (L052–L058), importing the module can modify the filesystem despite appearing to only load configuration.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally: