Security audit
Security checks for vulnerabilities and agentic risk
The skill is rated suspicious because scanners report sensitive video handling, account and credential activity beyond its stated monitoring purpose, and behavior that may run despite export-only options.
Consider the verdict suspicious and review the reported upload, HTTP configuration, account registration, and export-only behavior before installing. The scan was partial because a referenced local path was missing, so it does not establish the complete behavior or prove that the skill is safe.
skills/smyx_common/scripts/config-dev.yamlDevelopment configuration sends credentials and private analysis data over HTTP
A network observer can obtain transmitted authentication tokens and private video content or source URLs. An active intermediary can alter requests and responses. Token reuse depends on the remote service's token validity and enforcement, which were not tested.
Database persistence could be a legitimate supporting detail, but this chunk specifically implements account-management functionality, including username/real-name lookup, default-user selection, and storage of email, demographic details, and token fields. It contains no camera processing, nighttime event detection, baseline computation, or anomaly-alert logic. The mismatch is based on the concrete account-management purpose, not merely on using SQLite. This assessment is limited to the supplied chunk; it does not establish what other skill components do or indicate that stored data is transmitted externally.
Ordinary formatting, polling, and filesystem helpers could support the declared monitoring skill and are not themselves mismatches. However, this chunk also implements account provisioning, credential handling, and authenticated external-service access that the description does not disclose. Its request wrapper accepts absolute URLs and attaches configured credentials without a visible destination restriction. These capabilities are available when the functions are called; the chunk does not establish that they run automatically on import or that malicious exfiltration occurs. Because only a shared utility module is supplied, the missing video-analysis logic does not prove the complete skill lacks it, but the observed account and network behavior materially exceeds the declared purpose.
The visible implementation is generic scaffolding with a nonfunctional chat helper, materially different from the described sleep-routine monitoring system. No subprocess is actually executed, and no camera access or external transmission is demonstrated. Imported base classes and services are not supplied, so their behavior cannot be assessed; this finding is limited to the provided chunk.
The supplied code implements a generic analysis-service client and report interface rather than the specialized monitoring and anomaly-detection behavior described. File validation, service submission, polling, and report formatting could support the declared system, but do not establish its defining capabilities. Imported service implementations are not provided, so the backend might perform some specialized analysis; nevertheless, the supplied chunk contains no evidence of the continuous monitoring, historical baseline management, or threshold-based alerting promised by the description.
The supplied chunk implements a generic video-analysis wrapper, not the specialized monitoring and anomaly-detection workflow described. It contains no camera ingestion loop, nighttime scheduling, baseline calculations, or sleep-routine alert logic. The delegated skill implementation is not supplied, so some specialized analysis could exist there; however, this chunk alone does not substantiate the declared primary behavior. Identity resolution, history retrieval, and optional file output are supporting operations and are not independently treated as suspicious capabilities.
Without declared permissions the skill's intent is opaque and cannot be validated.
The export-only flag is parsed but never checked, so supplying it with an input still invokes the normal analysis path despite explicitly promising not to analyze. In a bedroom-camera skill, this can cause unintended processing and potential remote disclosure of highly sensitive footage.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The implementation reads the entire local video and passes its contents to the analysis API without an upload-specific notice or consent check. General references to cloud APIs and monitoring consent do not clearly establish authorization to transmit intimate bedroom footage to an external processor.
The --export-env-only argument is never consulted after parsing, so an invocation containing a video input still calls the analysis service. Users relying on the explicit no-analysis promise can unintentionally submit sensitive home-camera footage for processing.
A method documented as creating a record catches every insertion exception and instead attempts to overwrite an existing record by ID, then by username or realname. This can turn a rejected insert into unintended modification of identity and token fields, undermining data integrity in a privacy-sensitive monitoring system; exploitability depends on who controls the supplied model.
The docstring at L26 explicitly promises invocation of openclaw agent through subprocess, but both command construction and subprocess execution are commented out. Instead, L68 creates an empty dictionary, and accessing result.stderr raises an exception that is caught, causing the method to return None without performing the documented analysis.
The generic open helper always opens the supplied path in 'w' mode, immediately erasing existing contents. There is no docstring, comment, confirmation, or operation-specific log explaining this destructive behavior; exception tracing does not disclose successful truncation.
When credentials are missing, a generic HTTP request can automatically call a remote login endpoint with register=1 and silent=1, then persist returned credentials. No explicit enrollment approval is visible, making account creation and identity disclosure hidden side effects rather than a necessary consequence of local rhythm analysis.
The helper sends the current identifier as both openId and mobile while requesting silent account registration, without a visible consent check. In a home-monitoring skill, this can unexpectedly link a user's identity to an external service, although this particular request does not show video transmission.
The POST transmits the current identity and source metadata to a configured remote service as part of automatic registration. External networking alone is not a vulnerability, but this call has an undisclosed enrollment side effect with no visible approval gate; the destination's trustworthiness and transport configuration are not established here.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
YamlUtil.load creates parent directories and writes a YAML file when the requested path is missing, without a warning, log, comment, or docstring disclosing this side effect. BaseEnum.init_subclass invokes this loader at L053 and L058, so defining configuration classes during import can modify the filesystem without an explicit save operation.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
elif isinstance(cur, dict):
cur = cur.get(part, default)
else:
cur = getattr(cur, part)
return cur
except Exception:
return default