Back to skill

Security audit

Infant Prone Sleeping Asphyxia Alert Skill | 婴儿趴睡窒息预警技能

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its baby-sleep video analysis purpose, but it also silently creates and reuses cloud-linked identities, stores tokens locally, and retrieves history through broad automatic triggers.

Install only if you are comfortable sending infant sleep media, report metadata, and internally managed identity information to the configured lifeemergence cloud services. Review whether automatic history lookup, default user creation, local SQLite token storage, and report export links are acceptable for your environment, especially if the workspace contains private family or medical-adjacent data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, network access, environment-backed identity handling, and cloud API calls, yet no explicit permissions are declared. This creates a capability/consent mismatch: a host may expose broader powers than users or reviewers expect, increasing the risk of unintended file access, data exfiltration, or execution of unsafe commands through the bundled script path.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file documents pet health analysis APIs and scenario codes that are materially unrelated to an infant suffocation warning skill. This mismatch can cause the agent or integrators to call the wrong backend, expose unrelated health-report export capabilities, or blend sensitive domains in a way that increases the risk of unauthorized data access and unsafe behavior. In a safety-critical infant monitoring context, incorrect API wiring is especially dangerous because alerts may fail, use stale/irrelevant data, or leak unrelated medical information.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script exposes history retrieval tied to a user identifier through hidden OpenID handling, despite that function not being necessary for the stated infant-safety detection purpose. Hidden identity resolution and list access can expand the data-access surface and may enable unintended retrieval of user-associated analysis records if backend authorization is weak or assumptions about current-user binding are incorrect.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The implementation accepts arbitrary local file paths and arbitrary remote HTTP/HTTPS URLs, then forwards them to a generic analysis backend, which is materially broader than the declared infant suffocation warning purpose. This creates a scope-expansion and data-exfiltration risk: users or upstream agents may unknowingly upload unrelated sensitive local media or trigger server-side fetching of attacker-controlled URLs under the cover of a safety-focused skill.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill exposes report-listing and export-link generation functions that go beyond the manifest's real-time warning behavior. If these APIs are reachable without strong authorization checks in the surrounding system, they could leak historical analyses, identifiers, or report images unrelated to the current user session.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file exposes broad generic HTTP/CRUD functionality (`page`, `list`, `add`, `edit`, `delete`, and raw HTTP verbs) that is not constrained to the declared infant suffocation warning purpose. In a safety-focused skill, such unrestricted service wrappers materially expand capability and create a pathway for unauthorized data access, backend abuse, or hidden secondary behaviors unrelated to infant monitoring.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The `get_user_by_username` capability introduces user-account lookup behavior that is not justified by the skill’s stated function of detecting infant suffocation risks. Even if intended for convenience, unnecessary identity lookup increases privacy risk and can support user enumeration or access to account-linked information outside the safety use case.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The shared config class reads user-related identifiers from environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) even though this file belongs to a skill whose stated purpose is infant suffocation warning. Pulling identity data from process environment without clear scoping, minimization, or disclosure can leak or repurpose personal identifiers across unrelated skills, especially in multi-skill or shared-runtime deployments.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file defines a generic user account model and DAO storing usernames, real names, email, birthday, age, tokens, and other identity data, which is unrelated to the stated infant suffocation warning function. In a safety-monitoring skill context, collecting and persisting unrelated personal data increases privacy risk and broadens the attack surface without clear necessity.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The DAO initialization automatically creates a local SQLite database and prepares persistent storage, which goes beyond the manifest's real-time detection and alerting description. Hidden persistence is especially concerning in a child-safety skill because users may not expect local data retention or cross-skill shared storage.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The file for an infant suffocation warning skill exposes a generic `ai_chat` capability that is not constrained to the declared safety purpose. This creates a scope-mismatch/backdoor-like primitive that could be reused for arbitrary agent interaction, expanding the attack surface and enabling unintended data handling or remote prompt-driven behavior in a safety-critical skill package.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer contains broad remote API, credential-handling, and account-provisioning capabilities that are unrelated to an infant suffocation warning skill's declared purpose. In this context, the mismatch is dangerous because it enables hidden networked behavior and identity operations that expand the attack surface far beyond local safety analysis, increasing the risk of covert data exfiltration and unauthorized service interaction.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code automatically creates and persists user identities for remote services when no explicit identity is supplied. For a baby sleep safety alert skill, this is an unjustified capability that can silently establish external accounts, tie activity to generated identifiers, and create privacy and compliance risks without informed user approval.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code inspects environment-derived workspace locations and reads identity material from workspace files such as data/smyx-api-key.txt, which is outside the stated function of detecting infant sleep hazards. In this skill context, harvesting workspace context and identity sources is suspicious because it facilitates hidden credential discovery and cross-workspace access patterns unrelated to safety monitoring.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The skill says historical report lookup should auto-trigger on broad natural-language phrases like viewing history or report lists, and then 'must directly call' a cloud API. Ambiguous triggering can cause the agent to perform unintended remote data retrieval for users who did not clearly request it, which is especially risky because the reports are implicitly tied to an internally managed identity.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads the entire local file and uploads it for analysis without any visible consent, warning, or minimization controls in this component. For a baby-safety skill, this is especially sensitive because uploaded videos may contain infants, bedrooms, caregivers, and other private household data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Accessing environment variables that contain user identifiers without user-facing notice or clear necessity creates a privacy and security issue, because environment state is often inherited broadly and may contain sensitive identifiers from other workflows. In the context of an infant-monitoring skill, unexpected collection of unrelated identity attributes increases risk because the skill handles sensitive family/child safety scenarios where data minimization matters more.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Database initialization and table creation occur automatically on object construction with no user-facing disclosure or consent. Silent writes and state creation can surprise users, complicate auditing, and hide persistent behavior that is not obvious from the skill's stated safety-analysis purpose.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code performs automatic schema migration by altering the sys_user table at runtime without any user-facing notice. Undisclosed schema mutation can change what data is retained over time and makes the persistence footprint expand silently, which is risky in a skill that appears unrelated to account management.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The request path resolves and attaches credential-like values and user identity fields to outbound requests without any user-facing disclosure or consent flow. In a child-safety monitoring skill, undisclosed use of tokens and identities is particularly concerning because users expect protective functionality, not silent credential propagation to backend services.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The generic HTTP request function transmits user and system-derived metadata such as tenant code, skill hub name, platform name, and username to remote services. Because this behavior is embedded in a utility for a skill advertised as infant suffocation warning, it creates undisclosed data-sharing risk and broadens exposure of operational and user context beyond what the stated safety purpose implies.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2