Virtual Fence Crossing Alert Skill | 虚拟围栏越界预警技能

• Outcome: Review
• Latest audit: Aug 29, 2026 · 3:02 PM UTC
• Version: 1.0.12

Overview

The skill’s baby-safety analysis purpose is understandable, but it also uploads sensitive media, creates or reuses backend identity state, stores tokens locally, and retrieves cloud history with limited user control.

Review before installing. This skill sends uploaded home video/image content or media URLs to a remote analysis service, can query cloud-stored report history, and automatically creates or reuses local/backend identity state. It should only be used if you are comfortable with that remote processing and local token persistence, especially for child or home-monitoring footage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 78% confidence
• Finding: This code uses user-supplied filter keys to dynamically select model attributes with getattr(self.__model__, key) and applies them to queries without validating the field names. While SQLAlchemy parameterizes the values, untrusted callers can still enumerate or query unintended columns, bypass business restrictions, or trigger exceptions for invalid attributes, which can expose data or destabilize the service.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 76% confidence
• Finding: The count() method repeats the same unsafe pattern of using caller-controlled filter keys in getattr() without restricting which columns may be queried. This can enable unauthorized metadata disclosure about sensitive records, such as probing whether users or token-bearing accounts matching certain attributes exist.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises no explicit permissions while instructing use of capabilities equivalent to shell execution, network access, local file handling, and environment-backed identity/account behavior. This is dangerous because reviewers and users cannot accurately assess the trust boundary, yet the skill can invoke local scripts, access cloud APIs, and persist or retrieve data, increasing the chance of unauthorized data access or unintended side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is infant fence/intrusion warning, but the behavior described expands into historical report retrieval, internal identity resolution, local persistence, and remote login/token workflows that are not necessary for the claimed core safety analysis. This mismatch is dangerous because it can conceal broader data collection and account-linked operations under a benign childcare label, making over-privileged behavior harder to detect and easier to socially engineer into approval.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script includes functionality to resolve and use an internal OpenID and to list prior analysis records via `--list`, which is unrelated to the stated purpose of analyzing a provided video for fence intrusion. Even though the OpenID and API key are hidden from help output, the code still exposes an internal identity/listing capability that could enable unauthorized access to another user's analysis history or metadata if invocation is not otherwise restricted.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation does not perform baby virtual-fence intrusion detection as advertised; instead it exposes a generic media-analysis/report workflow. This capability mismatch is dangerous because users may trust it for infant safety monitoring while the code actually sends content to a separate analysis service and returns generic reports, creating a deceptive-security situation and increasing the chance of misuse or unsafe reliance.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This module exposes a broad, generic API client surface including paging, CRUD-like operations, and arbitrary HTTP methods that are not constrained to the stated baby-safety virtual-fence purpose. In a skill context, this creates an unnecessary capability expansion: any downstream code using this service can make unrelated network requests or perform unauthorized actions against backend APIs, increasing the blast radius if the skill or its inputs are abused.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The http_post/http_put/http_get/http_delete methods provide arbitrary network request capability to caller-supplied URLs without visible restriction in this file. For a specialized safety-monitoring skill, this is dangerous because it enables capability misuse, data exfiltration, unexpected backend interaction, or pivoting to unrelated services if any caller can influence the URL or request parameters.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: User lookup by username is unrelated to virtual-fence intrusion warning analysis and introduces an identity/query capability beyond the declared purpose of the skill. Even if intended for shared infrastructure, retaining this helper in the skill-accessible module increases the chance of unauthorized user enumeration or privacy-impacting access.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The model stores authentication-adjacent data such as token and open_token in a local SQLite database despite being unrelated to the stated baby-safety intrusion-warning purpose. This expands the attack surface and increases the impact of local file access or misuse, because sensitive identity material is retained without clear need or visible protection.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer performs broad remote API access, token handling, user lookup, silent login/registration, and response processing that are unrelated to a baby-safety virtual-fence skill. In this context, the excess capability greatly expands the attack surface and enables covert account/network activity under the guise of a safety feature.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can silently create or provision user identities by posting to a phoneLogin endpoint with register and silent flags, using derived local identifiers. For a baby-monitoring skill, hidden account creation is unjustified and can expose users to unauthorized account generation, telemetry linkage, and backend access without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code reads identity material from workspace data files and persists or reuses default open-id state across runs, which is unrelated to the declared purpose of intrusion warning analysis. This creates hidden identity coupling and increases the risk of unintended tracking, impersonation, or use of residual credentials from the local workspace.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default trigger rule is broad enough to auto-activate on loosely related user requests involving monitoring videos and boundary detection. In a skill that can save local files and call backend scripts/APIs, ambiguous activation raises the risk of unintended processing of user media or execution of sensitive operations without sufficiently specific consent.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The history-report keywords are broad and configured for automatic triggering, which can cause retrieval of cloud-linked report data when a user mentions generic report-related phrases. Because the skill also performs internal identity association, this may expose account-specific historical data more easily than intended and bypass meaningful user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code reads arbitrary local file contents and uploads them to the analysis API with no disclosure, confirmation, or visible consent flow in this file. In a safety-monitoring context, this can expose sensitive home video or child imagery to remote services unexpectedly, creating privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The hidden `--api-key` parameter suppresses user-facing disclosure while still accepting credential material on the command line. Command-line secrets are commonly exposed through shell history, process listings, logs, and debugging output, and hiding the flag reduces transparency about sensitive input handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debugging are turned on globally, which can emit request and response metadata and potentially sensitive payloads or tokens into logs. Because this skill handles identity and API tokens, verbose transport logging is especially risky and unnecessary for a baby-safety feature.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill reads a workspace file containing identity data without any user-facing notice or consent flow. While file reading alone is limited, in this code it feeds subsequent identity resolution and remote API behavior, making the undisclosed access more concerning in context.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: The code transmits locally derived identity data to an external /sys/phoneLogin endpoint to obtain or create backend user state. External transmission is materially risky here because it is hidden inside utility code for a child-safety skill and is not obviously necessary to perform virtual-fence detection.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2