smyx_infant_cry_cause_classification_analysis | 婴幼儿哭声原因分类

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:40 PM UTC
• Version: 1.0.5

Overview

The skill appears to perform cry analysis, but it also uploads sensitive infant media to a cloud service and silently creates or reuses account identity data.

Review this skill carefully before installing, especially if recordings may include infants, household audio, or private video. It should only be used if you accept cloud processing by the configured service, automatic account/identity creation or reuse, local token storage in the workspace, and cloud history retrieval tied to that identity.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 82% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no declared permissions, yet its documented behavior includes shell execution, local file read/write, network access, and likely environment use. This creates a transparency and review gap: operators may authorize the skill without understanding that it can persist files, call remote services, and execute scripts, which materially expands attack surface and data-exfiltration risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is simple infant-cry classification, but the skill also describes remote historical-report access, persistent identity creation, local token/database storage, and backend registration/login behavior. This mismatch is dangerous because users and reviewers may consent to an audio-analysis tool while unknowingly enabling account provisioning, data retention, and remote access workflows involving sensitive child-related data.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill claims acoustic cry analysis, but expands accepted inputs to images, generic video, local files, and remote URLs. This broadens the ingestion surface beyond the stated purpose, increasing the chance of unexpected data collection, unsafe remote fetching, and misuse of unrelated media under the guise of a narrowly scoped audio classifier.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The addition of cloud-based historical report querying goes beyond the stated real-time classification function and introduces access to stored user-linked records. In the context of infant monitoring, historical reports may contain sensitive behavioral data, so undocumented retrieval capabilities materially increase privacy and data-governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill mandates automatic cloud API access for historical report retrieval even though that capability is not clearly necessary for classifying a provided cry sample. This creates unnecessary remote data flows and account-linked lookups, increasing the risk of unauthorized disclosure of sensitive childcare records if triggered unexpectedly or without informed consent.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: Automatically saving uploaded attachments to local storage is an extra persistence behavior not obviously required by the stated function. Because the media may include infant audio/video, silent local retention increases privacy exposure and the chance of accidental leakage from disk, backups, or other local processes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a hidden `--list` mode that retrieves prior analysis records tied to an internal `open_id`, which is outside the advertised function of classifying a user-supplied infant cry sample. In a baby-monitor context, this can expose sensitive historical data about household activity or infant events, and the hidden nature of the feature increases the risk of unauthorized or unexpected data access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code initializes an internal identity mechanism via `OpenIdUtil.resolve_current_open_id(...)` even when the core operation is simple media classification. In this context, tying analysis behavior to internal identity state can enable cross-user data access, implicit tracking, or unintended linkage of sensitive infant-audio analyses to user accounts without transparent consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This service exposes generic add/edit/delete and arbitrary HTTP GET/POST/PUT/DELETE wrappers that are far broader than the declared infant-cry classification purpose. In a baby-monitoring context, these capabilities increase the attack surface for unauthorized data exfiltration, remote actions, or abuse by other parts of the skill, especially because the code imposes no visible allowlist, authorization guard, or purpose limitation.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The get_user_by_username capability is unrelated to classifying infant cries and introduces unnecessary access to account-identifying information. Even if intended for platform integration, exposing user lookup from this skill creates privacy and enumeration risk that is not justified by the stated feature set.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This infant-cry analysis skill includes a general-purpose user account persistence layer with fields such as username, realname, email, birthday, and tokens, which is unrelated to the stated functionality. Unnecessary identity and token storage expands the attack surface and increases privacy risk, especially in a baby-monitor context that may already process sensitive household data.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs backend authentication, token management, user lookup, possible account creation, and arbitrary remote API interaction that is unrelated to infant cry classification. In the context of a baby-monitor analysis skill, this creates an unnecessary capability to transmit identifiers, obtain credentials, and interact with external services, expanding the attack surface well beyond the declared function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can silently create or register backend identities by deriving a username/open-id and calling a remote phoneLogin/register flow. Automatic identity provisioning without user awareness is dangerous because it can create undeclared accounts, bind local behavior to remote identities, and expose users to tracking or unauthorized service enrollment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill reads identity material from workspace files and persists identity state locally, despite that behavior being unrelated to infant cry analysis. This creates hidden identity coupling across runs and agents, increasing the risk of privacy leakage, unintended account reuse, and abuse of local credentials or identifiers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill says uploaded media will be automatically saved locally but does not clearly warn users in a prominent way that their audio/video will be written to disk. This is especially sensitive here because recordings of infants and home environments may contain highly private information, so undisclosed storage undermines informed consent and privacy expectations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill requires automatic cloud API queries for historical reports without clearly warning users that report data will be sent to or retrieved from a remote service. In a child-monitoring context, silent remote processing or retrieval can expose sensitive family and infant data to third-party infrastructure without meaningful informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads the entire local file and sends it to a remote analysis service without any user-facing disclosure, consent prompt, or visible privacy notice in this layer. In the context of baby-monitor or smart-camera recordings, this can involve highly sensitive household audio/video, making silent upload a meaningful privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script accepts a suppressed --api-key argument and can perform analysis on local files or remote URLs without clearly disclosing credential use or network transmission to the user. In the context of a baby-monitor/infant-analysis skill, this is more sensitive because it may involve private household media and hidden credential-backed uploads to an external service.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code trusts an environment-derived workspace path and uses it to determine where data and skills are located, without validation or disclosure. In an agent environment, this can redirect file operations into unexpected locations, causing unauthorized access to another workspace's files or cross-agent contamination if the environment is manipulated.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Automatically creating the agent skills directory gives the utility code the ability to prepare or modify the execution environment for additional skills without clear user awareness. In combination with workspace auto-detection, this can facilitate persistence or unauthorized installation behavior beyond the stated cry-analysis purpose.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The request wrapper automatically attaches tokens, API keys, tenant identifiers, and usernames to outbound requests, with no user-facing disclosure and no clear limitation to cry-analysis functionality. In a baby-monitor context, hidden transmission of identifiers and credentials is especially risky because users may reasonably expect local or narrowly scoped processing for sensitive family-related data.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 wav/mp3/m4a/aac/opus 音频或 mp4/avi/mov 视频，最大 10MB；建议背景安静 |
| 🧑‍⚖️ 结果性质 | 分类结果仅作为育儿辅助参考，不替代专业儿科诊断；婴儿持续异常哭闹请就医 |
| 🔏 隐私合规 | 隐私合规：婴儿音频涉及未成年人隐私，使用前需取得监护人知情同意，并妥善保管/加密相关录音 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |

• Confidence: 88% confidence
• Finding: ‍

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2