Back to skill

Security audit

Elderly Fall Detection Skill | 老人跌倒检测技能

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches fall-detection and report lookup, but it silently creates or reuses an identity, contacts external services, and stores authentication tokens locally.

Review this skill before installing if you are comfortable sending home-monitoring photos or videos and account-linked report requests to lifeemergence.com services. Also consider that it may silently create or reuse a local identity and keep service tokens in a shared workspace SQLite database.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no explicit permissions while its documented behavior clearly requires shell execution, local file handling, network access, and likely environment/config usage. This mismatch prevents informed review and consent, and is especially risky here because the skill processes sensitive home-monitoring media and historical elderly-care reports.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The stated purpose is fall detection, but the workflow also includes historical report enumeration, silent identity creation/reuse, local persistence, remote platform login, token management, and report-link export. That broader behavior materially expands the data-access surface and can expose user records and credentials beyond what a user would reasonably expect from an analysis-only safety skill.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The file exposes a generic user lookup helper (`get_user_by_username`) that is not obviously required for an elderly fall-detection skill. In this context, extra identity-query capability expands the reachable data surface and could enable unauthorized user enumeration or access to unrelated account information if higher-level callers misuse it.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
This class provides broad CRUD methods and arbitrary HTTP verb wrappers (`add`, `edit`, `delete`, `http_post`, `http_put`, `http_get`, `http_delete`) that can be pointed at caller-supplied URLs, far exceeding the narrow purpose of fall detection. Such generic network primitives create a reusable control plane for unrelated remote actions, increasing the risk of data exfiltration, unauthorized modifications, or abuse of backend services if invoked by other parts of the skill.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is described as elderly fall detection, but this file implements persistent shared user/account management logic unrelated to that narrow purpose. Collecting and centralizing identity records outside the stated function increases privacy risk and expands the attack surface, especially because the database is intentionally shared across skills/workspaces.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The User model stores identity fields and multiple token fields, including token and open_token, which are sensitive secrets not obviously required for fall detection. If this local shared SQLite database is accessed by other components or compromised, attackers could recover account identifiers and reusable authentication material.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This utility module implements broad agent workspace discovery, skill-directory management, identity resolution, and local user/account persistence that are unrelated to the stated elderly fall-detection purpose. That scope expansion increases the attack surface and enables the skill to inspect or modify agent workspace state beyond what users would reasonably expect from a safety-monitoring skill.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The code automatically logs in or registers users against external health-related APIs and manages tokens during ordinary HTTP requests, which is outside the manifest's declared fall-detection behavior. In this context, silently creating accounts and transmitting identifiers materially increases privacy and security risk because users invoking a fall-detection skill would not expect identity provisioning against unrelated remote services.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill reads an identity value from a workspace file and, if absent, generates and persists a default user identity in a local database. For a fall-detection skill, this credential and identity persistence is not clearly necessary and creates a risk of unauthorized reuse, cross-skill tracking, and leakage of user-linked identifiers from local storage.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The history-query trigger phrases include broad terms such as requests to view reports/lists, which can cause the skill to invoke cloud history retrieval in conversations that did not intend account-level data access. In this context, accidental triggering is more dangerous because the returned data concerns sensitive elderly monitoring events and prior reports.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The default-trigger language is overly broad, causing the skill to auto-run whenever images or videos relate to fall detection without clear boundaries or consent checkpoints. Because the skill may save local files and contact remote services, a vague trigger can lead to unnecessary processing of sensitive home-surveillance content.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments or media are automatically saved as local files, but it does not clearly notify the user about retention, location, duration, or downstream use. For elderly home-monitoring images and videos, undisclosed local storage creates privacy and compliance risk if the files contain intimate in-home surveillance data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill mandates direct cloud API access for historical report retrieval but does not clearly warn users that sensitive report data will be requested from and exposed via a remote service. In a healthcare-adjacent monitoring context, undisclosed remote processing increases the risk of privacy breaches, over-collection, and noncompliant handling of personal data.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill reads the entire local video file and submits it to an analysis service without any visible consent prompt, warning, or minimization controls in this code path. Because the skill targets in-home elderly monitoring, the uploaded media is likely highly sensitive and may contain bystanders, interiors, and health-related events, increasing privacy risk.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The script accepts a hidden --api-key argument and forwards credential-related operation without any user-facing disclosure, safer input mechanism, or guidance on avoiding shell-history exposure. In a CLI context, secrets passed as arguments can be exposed via process listings, shell history, logs, or job-control tooling, creating a realistic credential-leak risk.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code trusts the OPENCLAW_WORKSPACE environment variable to select the workspace root without user-facing disclosure. In a multi-agent environment, consuming environment-derived paths can expose or redirect file operations into sensitive locations, especially when the skill later creates directories and reads/writes identity-related files there.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The utility automatically creates workspace data and skills directories without user-facing disclosure or clear need for the advertised fall-detection function. Silent filesystem mutation in a shared agent workspace can enable persistence, cross-skill interference, or installation-like behavior that exceeds normal user expectations for this skill.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads an internal identity file from the workspace data directory without transparency to the user. Because this file is then used for identity resolution and downstream requests, it can silently bind the skill's actions to an existing local identity and enable unexpected data sharing or account linkage.

Missing User Warnings

High
Confidence
97% confidence
Finding
This request helper automatically attaches app IDs, tokens, API keys, and user identifiers to outbound requests and may obtain or refresh those credentials as part of normal operation, all without user-facing warning. In the context of a fall-detection skill, silent transmission of identity and authentication data to external services is particularly dangerous because it exceeds the declared purpose and creates privacy, tracking, and account-abuse risks.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:jpg/jpeg/png/mp4/avi/mov,视频推荐短时连续帧,最大 10MB |
| 🧑‍⚖️ 结果性质 | **⚠️ 重要提示**:本检测结果仅供安全预警参考,不能替代人工确认,发现跌倒报警请立即电话联系核实并应急处理 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
71% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "elderly-fall-detection-analysis"
description: "Utilizes vision and radar technology for contactless detection of falls. It triggers alarms within seconds and is suitable for home safety monitoring of elderly people living alone. | 老人跌倒检测技能,视觉/雷达无感识别摔倒倒地,秒级触发报警,适用于独居老人居家安全监测场景"
version: "1.0.9"
license: "MIT-0"
---
Confidence
78% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2