Back to skill

Security audit

Infant Blanket Kick Detection | 老年人夜间离床时长与徘徊识别

Security checks across malware telemetry and agentic risk

Overview

The skill matches its monitoring purpose, but it should be reviewed because it sends highly sensitive bedroom-monitoring media and identity-linked report requests to cloud services while silently creating and persisting user identity data and tokens.

Install only if users have informed consent to process bedroom or hallway monitoring footage through Life Emergence cloud services, and if you are comfortable with the skill silently reusing or creating an internal identity, storing tokens locally, and querying cloud report history tied to that identity. Prefer using it in a dedicated workspace and avoid submitting sensitive URLs or videos unless the retention, access-control, and account-provisioning model is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill manifest describes capabilities to read/write files, access the network, inspect environment state, and invoke shell commands, yet it declares no explicit permissions or constraints. This creates a capability/authorization mismatch that can lead to over-privileged execution, opaque data handling, and unsafe access to sensitive local files or remote services.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
Allowing arbitrary remote URLs for video analysis expands the trust boundary and can enable server-side fetching of attacker-controlled resources. If downstream code retrieves the URL server-side, this can introduce SSRF-style access to internal services, processing of untrusted content, or privacy misuse beyond the stated nursing-home bedroom-monitoring purpose.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The model stores token and open_token values in a local SQLite database as ordinary string fields, with no evidence of encryption, hashing, minimization, or access controls. For a bedside monitoring skill handling elderly residents, retaining authentication tokens beyond the stated purpose materially increases the risk of credential theft, account takeover, and privacy compromise if the host or database file is accessed.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
This utility layer performs broad authenticated remote API access, token handling, account lookup, retry logic, and user-context injection that exceed the stated bedside monitoring purpose. In a bedroom-monitoring skill handling vulnerable populations, hidden generic network access increases the risk of covert data exfiltration, unauthorized backend actions, and privilege misuse without clear user awareness.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code automatically resolves, creates, or persists an open-id and local user record when none is supplied, including generating synthetic identities and storing them for reuse. That behavior is not necessary for local night monitoring and can silently provision accounts against remote services, creating unauthorized identities, consent issues, and a channel for backend access under fabricated or undisclosed user context.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code inspects environment variables and filesystem layout to discover the agent workspace and then creates data and skills directories automatically. While this is not inherently malicious, it grants the skill broad knowledge of agent-local storage locations and write capability that are unrelated to the declared monitoring function, increasing the blast radius for data access or persistence abuse if other parts of the skill are compromised.

Intent-Code Divergence

Low
Confidence
87% confidence
Finding
The code claims it avoids printing full headers for safety, but debug/error paths still emit substantial request context including URL, params, data, response details, and header-related labels. In this skill, request bodies can contain user identifiers, tenant codes, and other sensitive metadata, so debug logging can expose confidential information in logs or consoles.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default trigger activates automatically whenever a user provides a night-monitoring video, without a strong confirmation boundary. In a privacy-sensitive elderly bedroom surveillance context, this can cause unintended processing of highly sensitive footage and downstream API submission without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The keyword trigger list is broad and overlaps with normal caregiving, monitoring, and reporting language, increasing the chance of accidental invocation. Because the skill can save local files and query cloud APIs tied to automatically resolved identities, ambiguous triggering may lead to unintended analysis or disclosure of historical report data.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation describes continuous nighttime surveillance of elderly individuals and alerting behavior outputs, but it does not mention privacy safeguards, consent, retention limits, access controls, or compliance obligations. In a nursing-home/home monitoring context, this omission can lead implementers to deploy invasive monitoring features without appropriate protections, increasing the risk of privacy violations and misuse of sensitive behavioral data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script initializes an internal identity via `OpenIdUtil.resolve_current_open_id(...)` without clear user disclosure, even though the argument is hidden from help output. In a sensitive monitoring context involving elderly bedroom surveillance, silently binding actions or data access to an internal identity can enable unauthorized tracking, data association, or retrieval of analysis records without informed consent or clear accountability.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The tool accepts a remote video URL for analysis without warning users that bedroom surveillance footage may be fetched from or transmitted to remote systems. In this context, the data is highly sensitive health- and privacy-related content, so undisclosed remote handling increases the risk of privacy violations, unintended third-party exposure, and compliance failures.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This code accepts either a local video file or a remote video URL and forwards that content to an analysis service, but there is no in-code user disclosure, consent prompt, destination transparency, or restriction on what URLs may be submitted. In this skill’s context—night-vision bedroom monitoring of elderly people—the uploaded data is highly sensitive health and private living-space footage, so silent transfer to external services materially increases privacy, compliance, and data-exfiltration risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The function reads an identity value from a workspace file and uses it as an internal open-id without any visible consent, prompting, or provenance validation. For a bedroom monitoring skill, silently sourcing persistent identity from local storage increases privacy risk and can bind monitoring actions or remote requests to an undisclosed user account.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request wrapper automatically attaches user identity, tokens, app identifiers, tenant codes, and platform metadata to outbound HTTP requests without clear user-facing disclosure. Given the skill monitors elderly individuals in private bedrooms, undisclosed transmission of authentication and user-context data materially increases privacy, compliance, and misuse risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-elderly-night-bed-exit-wandering-analysis"
description: "Using fixed cameras (infrared night vision) in nursing-home or home bedrooms, the system continuously monitors elderly bed-exit status and activity trajectory at night. | 通过养老院或居家卧室的固定摄像头(红外夜视),夜间连续监测老年人的离床状态和活动轨迹。输出异常预警,可联动护理人员手机或护士站大屏,防止老人走失、跌倒或发生意外。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
83% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2