smyx_infant_cry_cause_classification_analysis | 婴幼儿哭声原因分类

• Outcome: Review
• Latest audit: Aug 25, 2026 · 8:12 PM UTC
• Version: 1.0.10

Overview

The skill appears to run a cloud-backed generic media analysis flow under an infant-cry label, with silent identity creation and local token persistence that users should review before installing.

Install only if you are comfortable with uploaded infant or household media being processed by the configured backend, a local default identity and token-bearing user record being created or reused, and cloud history/report links being retrieved. Review backend configuration and retention/deletion controls before using real child-monitoring recordings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 74% confidence
• Finding: This code accepts filter keys and resolves them directly as model attributes via getattr(self.__model__, key) without validating that the caller is allowed to query on those fields. While SQLAlchemy still parameterizes values and prevents classic SQL injection, an attacker controlling filter keys can enumerate or query sensitive columns and trigger errors or unintended data exposure through overly broad generic querying. In this skill, a general-purpose user DAO is unrelated to infant-cry classification, which increases concern because it expands local data access beyond the declared function.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 72% confidence
• Finding: As in list(), count() allows caller-supplied filter keys to be turned into ORM attributes without field-level validation. This can enable unauthorized probing of record existence or metadata on sensitive fields, even if it does not lead to raw SQL injection. In the context of a baby-cry analysis skill, this generic user/account counting capability is outside expected functionality and broadens privacy risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises no explicit permissions while its documented behavior requires environment access, local file read/write, network access, and shell execution. This creates a transparency and consent gap: users and reviewers cannot accurately assess the actual data exposure and execution surface, especially because the skill handles infant audio and cloud-backed history queries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is infant cry classification, but the described/runtime behavior expands into identity creation, token acquisition, local database persistence, and cloud history retrieval unrelated to the stated function. That mismatch is dangerous because it can conceal credential handling and persistent tracking behind an innocuous childcare use case, increasing the chance of unauthorized data collection and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill broadens itself from infant cry audio analysis to general image/video analysis and arbitrary local/network file handling. This unjustified expansion increases attack surface and data exposure by enabling processing of unrelated media types and sources, which is especially sensitive in a childcare context where bystander, household, and infant data may be collected.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation adds cloud history querying and report-link generation beyond the stated analysis-and-notification use case. This introduces additional remote data access and possible exposure of prior infant-related records without sufficiently prominent disclosure or scoping, increasing privacy and authorization risk.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Automatically saving uploaded files locally is not necessary for every cry-classification request and creates avoidable retention of sensitive recordings. Because the recordings concern minors and home environments, unnecessary local copies materially increase privacy, breach, and forensic recovery risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Automatic identity initialization, default-user reuse, and auto-creation are unrelated to basic cry analysis and can silently bind data to persistent identities. In this context, that can cause cross-session data mixing, unauthorized access to another user's infant reports, and hidden account creation without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as infant-cry analysis, but it exposes a pet-type selector with cat/dog values and mutates a global default used by downstream analysis. This indicates code reuse or hidden cross-domain behavior that can cause misclassification, unsafe recommendations, and unpredictable processing in a child-care context where users may rely on outputs for health-related decisions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a single-purpose cry-cause classifier, but the code also supports listing prior analyses tied to a user identity. That expands the skill from analysis into historical data access, which creates an undisclosed privacy surface and may expose previous sensitive infant-monitoring results to whoever can invoke the list behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code initializes an internal user identity and uses it to retrieve analysis history, despite that behavior being unrelated to local infant cry classification. In a monitoring context involving infants and home devices, hidden identity resolution and account-linked data access increase the risk of unauthorized access to sensitive behavioral data and make the skill more dangerous than a simple classifier.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation accepts local files or remote video URLs and submits them for a generic analysis workflow, while the skill metadata promises infant cry cause classification from audio. This mismatch can cause users to upload sensitive baby-monitor recordings under false assumptions about purpose, modality, and downstream processing, creating a privacy and trust violation with potential unsafe caregiving decisions based on unrelated output.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The output layer presents a generic structured analysis report and export link rather than a constrained infant-cry prediction with cause/confidence as described in the skill metadata. In a baby-care context, this increases the chance that users interpret unrelated report content as medical or caregiving guidance, which is especially risky because the domain involves infants and potentially urgent discomfort or pain.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the declared skill purpose: it performs video analysis and history retrieval rather than infant cry audio classification. This kind of capability mismatch is dangerous because it can mislead reviewers and users about what data is collected and processed, enabling unauthorized access to or transmission of more sensitive media than expected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code exposes a history-listing path keyed by open_id, which is not necessary for the stated cry-cause classification function. In the context of a baby-monitoring skill, access to account-scoped historical media analysis increases privacy risk and may enable unauthorized enumeration or retrieval of sensitive household activity if identity handling is weak elsewhere.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: User-facing strings and CLI help describe a video analysis tool, directly contradicting the declared infant cry audio classification purpose. This deceptive or inaccurate presentation increases the chance that users will submit the wrong kind of sensitive data and weakens informed consent, especially in a child-monitoring context where audio/video content is highly sensitive.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This service exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the declared infant-cry classification purpose. In a skill handling sensitive baby-monitor data, these wrappers enlarge the attack surface and can be repurposed by other code paths to send, modify, or delete remote data through unintended endpoints.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The user lookup helper is unrelated to infant cry cause classification and introduces unnecessary identity-related functionality into a privacy-sensitive skill. Even if not immediately exploitable here, unrelated account-oriented access increases the chance of user enumeration or improper access to personal data when reused elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The file defines shared user/account database functionality, including persistent user identity fields such as username, realname, email, token, and open_token, which is unrelated to the advertised infant cry cause classification behavior. This mismatch increases the risk of unnecessary collection, retention, or cross-skill reuse of personal data, especially in a product likely handling family and child-related information.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This DAO provides broad local database CRUD, schema creation, path redirection, and migration behavior that goes well beyond the manifest's stated cry-analysis function. Such surplus capability increases attack surface and enables storage or manipulation of unrelated local data, creating privacy and integrity risks if the skill or adjacent components are compromised.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This utility module contains broad identity management, token handling, backend login, and remote request logic that is unrelated to infant cry cause classification. That mismatch increases the risk that installing or using the skill silently provisions accounts, persists credentials, and communicates with external services beyond the user's reasonable expectations, creating a hidden data/authority expansion path.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code automatically derives or creates a default open-id, persists it locally, and reuses it for backend access without a clear user action tied to the infant-monitoring purpose. Silent identity creation can bind activity to an unintended account, enable unnoticed backend enrollment, and make subsequent external requests appear authorized even when the user never explicitly consented.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The workspace-detection logic inspects environment variables and filesystem layout to infer agent roots and create operational directories. While this may support platform behavior, it is unrelated to infant cry analysis and expands the skill's awareness of the local environment, which can be abused for unintended data access, persistence, or cross-workspace effects if combined with other code.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Overly broad trigger phrases for history-report queries can cause the skill to invoke remote report-listing behavior unexpectedly. That is dangerous because a casual mention of crying history or reports may retrieve sensitive infant-related records or initiate networked actions the user did not clearly intend.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill does not clearly warn users that infant audio-derived data may be transmitted to cloud services and pushed to an app. Given that the data concerns minors and potentially continuous household monitoring, inadequate disclosure undermines informed consent and can lead to serious privacy and compliance issues.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2