ClawHub
Back to skill

Security audit

Fall Detection & Analysis Skill | 跌倒检测分析技能

Security checks across malware telemetry and agentic risk

Overview

The skill performs fall-detection analysis, but it also silently handles identity, account login/registration, token storage, history retrieval, and is configured for private HTTP development endpoints.

Review carefully before installing. This skill may send care-related images or videos and generated identifiers to remote services, create or reuse an account silently, store authentication tokens in a local SQLite database, and query cloud history. The published config should be fixed to documented HTTPS production endpoints with clear consent, retention, and deletion terms before normal use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
77% confidence
Finding
Here, filter keys come from the caller and are passed into getattr(self.__model__, key) without validation. Although this is not classic SQL injection because SQLAlchemy still parameterizes values, untrusted keys can expose unintended model attributes, trigger exceptions for invalid names, and enable unauthorized querying over sensitive fields such as token, email, or deletion status if higher layers pass user-controlled filters through.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
76% confidence
Finding
This count() helper repeats the same pattern of accepting arbitrary caller-supplied filter keys and resolving model attributes dynamically. In practice this can be abused to probe for the existence of records matching sensitive attributes or cause denial-of-service style errors via invalid attribute names, depending on how the DAO is exposed.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill manifest advertises no explicit permissions, yet the documented behavior requires shell execution, local file read/write, network access, and likely environment access. This under-declaration prevents informed review and consent, and can hide a larger attack surface than users or platform policy expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The stated purpose is fall detection, but the documented and inferred behavior extends into identity bootstrapping, remote login/account creation, token handling, local user persistence, and historical report retrieval. That mismatch is dangerous because it obscures collection of credentials/identifiers and creates undisclosed authentication and data-retention behavior unrelated to a simple analysis skill.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script exposes a hidden `--open-id` parameter and a `--list` mode that retrieves analysis history via `skill.get_output_analysis_list(open_id=...)`, which goes beyond the advertised fall-detection function. Because the identity parameter is suppressed from help text rather than removed or access-controlled, this creates an insecure direct access pattern where a caller may enumerate or retrieve another user's analysis records if downstream controls are weak or absent.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The comment states that user input is not required for identity initialization, but the code still accepts `args.open_id` and passes it into `OpenIdUtil.resolve_current_open_id(...)` when present. This mismatch can mislead reviewers and operators, and in a privacy-sensitive monitoring tool it increases the chance that identity selection is user-influenced when it should be fixed to the current authenticated principal.

Context-Inappropriate Capability

Low
Confidence
78% confidence
Finding
The file exposes a history-list retrieval path via `show_analyze_list(open_id)` that is outside the stated purpose of fall detection on supplied media. In a monitoring context involving elderly care or nursing homes, historical analysis listings may contain sensitive operational or personal information, so unnecessary retrieval functionality increases privacy and data-exposure risk if invoked by unauthorized or overprivileged users.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
This file exposes broad generic network and CRUD primitives (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`) that are not constrained to fall-detection image/video analysis. In an agent skill context, such reusable arbitrary HTTP capabilities can be repurposed to access unrelated internal/external services, move data, or perform unintended actions, significantly expanding the attack surface beyond the declared purpose.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The `get_user_by_username` capability introduces user-account enumeration or lookup functionality that is unrelated to detecting falls in images or short videos. In this skill context, unrelated identity-access features increase the chance of privacy violations, unauthorized data access, or use of the skill as a stepping stone for broader account discovery.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The file defines persistent user/account management with usernames, real names, email addresses, birthdays, and tokens, which does not align with a fall-detection image/video analysis skill. This mismatch increases suspicion because unrelated identity storage expands the attack surface and creates privacy/security exposure without a clear functional need in the declared skill context.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores highly sensitive identity and authentication data including token and open_token alongside personal information. For a fall-detection analysis skill, collecting and persisting such data is unjustified and dangerous because compromise of the local SQLite database would expose credentials and personal data unrelated to the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
Automatic database initialization and schema mutation for a sys_user table are unrelated to the advertised fall-detection functionality. In this context, unrelated persistence logic is more dangerous because it silently creates a long-lived repository for user data and may support behavior outside the user's expected scope.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility file contains open-id resolution, local identity reuse, API-key-file reading, and automatic account bootstrapping logic that is unrelated to fall-detection image/video analysis. In the context of a narrowly scoped safety-monitoring skill, this scope expansion is dangerous because it silently introduces identity management and persistence behaviors that can create unauthorized account linkage, hidden state, and unexpected data handling.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The generic HTTP helper performs phone-login style account creation/login, token management, retry logic, and payment/recharge messaging that do not match the declared purpose of a fall-detection skill. This mismatch increases risk because a user invoking image analysis would not reasonably expect hidden authentication workflows, account mutation, or monetization-related control flow inside a low-level request helper.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads an internal identity value from a workspace file (data/smyx-api-key.txt) and uses it as an open-id source without any obvious user disclosure in this file. In a fall-detection skill, silently harvesting identity material from workspace storage is not justified by the feature set and can lead to unintended identity binding and privacy leakage.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code generates synthetic local user identifiers and persists user records in a local database when no identifier is present, even though the skill is supposed to analyze images/videos for falls. This creates hidden identities and durable account state unrelated to the user-visible function, which can enable tracking, accidental account creation, and unexpected downstream API actions under a fabricated or reused identity.

Intent-Code Divergence

Low
Confidence
82% confidence
Finding
Although the comment says headers are not printed for safety, the debug/error paths still emit request metadata, response objects, and payload details, and include a misleading 'headers' label in formatted output. In debug deployments this can expose sensitive request context, identifiers, or server responses into logs, which is especially risky because the same helper also manages tokens and identity-related traffic.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases for historical report access are broad enough that ordinary user requests about reports may automatically invoke cloud history retrieval. In a monitoring context, that can expose prior sensitive safety reports without a strong confirmation step, especially when report association is handled implicitly through internal identity state.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill says uploaded images and videos are automatically saved locally, but it does not provide a clear user-facing notice about retention, location, protection, or deletion of those files. Because the content may include sensitive elder-care monitoring footage, silent local persistence increases privacy and unauthorized access risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code reads the entire local file into memory and submits it to an external analysis API, but this file contains no user-facing notice, confirmation, or consent step before upload. In a fall-detection skill used for home care or nursing-home monitoring, the uploaded content is likely to contain sensitive images or video of identifiable individuals, making undisclosed transmission a meaningful privacy and compliance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This path consumes an internal identity value from workspace storage without any visible user-facing disclosure or consent mechanism. For a fall-detection skill, that covert identity sourcing is contextually more suspicious because the feature does not inherently require silently reading a local identity file.

Missing User Warnings

High
Confidence
98% confidence
Finding
The helper automatically sends login/registration requests with a user identifier to a remote endpoint using 'silent' and 'register' flags, with no user-facing notice in this code path. That is dangerous because it performs account-affecting network actions behind the scenes, creating privacy, consent, and unauthorized account creation risks unrelated to image/video fall detection.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The shared HTTP helper automatically attaches authorization headers, user identifiers, and request data to outbound requests without any user-visible disclosure in this file. While outbound API calls may be expected for cloud inference, the broad helper behavior combined with hidden identity/account logic makes the transmission more dangerous than a normal media-analysis API client.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
This line transmits registration/login data, including openId/mobile/source fields, to an external service. External transmission alone is not inherently unsafe, but here it is risky because it supports silent account provisioning unrelated to the skill's stated fall-detection purpose and may send identifiers without informed user consent.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：jpg/jpeg/png/mp4/avi/mov，视频时长建议 5 秒以内，最大 10MB |
| 🧑‍⚖️ 结果性质 | **重要提示**：分析结果仅供安全参考，不能替代人工确认，发现疑似跌倒请立即联系确认并应急处置 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |
Confidence
72% confidence
Finding
The finding indicates hidden or non-obvious instruction content in the manifest area, which is risky because invisible or obfuscated text can steer agent behavior in ways reviewers do not notice. In a skill that already includes strong execution directives and cloud-report behavior, hidden content raises suspicion of instruction smuggling or policy bypass.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2