Back to skill

Security audit

Autism Spectrum Disorder Behavior Analysis Tool | 孤独症谱系障碍行为分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it handles sensitive child-health videos and report history through cloud services while silently creating or reusing local identities and tokens.

Review before installing. Use this only if you are comfortable sending child behavioral videos or URLs and identity-linked report requests to the publisher's cloud service, and expect it to create local workspace state containing identifiers and tokens. For this kind of health-related content, get appropriate consent and understand retention/deletion practices first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to execute local Python scripts, read and write local files, access environment-derived identity parameters, and call remote APIs, yet it declares no permissions or capability boundaries. This creates a mismatch between what the skill can do and what reviewers or users would expect, increasing the chance of unsafe execution, unreviewed data access, and accidental exfiltration of sensitive child video data or report metadata.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The CLI initializes a hidden internal identity via OpenIdUtil.resolve_current_open_id and exposes a hidden --list mode that retrieves prior analysis history, which exceeds the advertised purpose of analyzing a supplied video. Hidden identity resolution and history access can expose sensitive user metadata or prior medical-analysis records without clear user awareness or consent, especially given the health-related context.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
This file implements a generic API client with broad CRUD and arbitrary HTTP capabilities that are not constrained to the skill's declared autism video analysis purpose. Such reusable network wrappers can be abused by other parts of the skill to access, modify, or delete remote resources beyond expected scope, increasing the blast radius if the skill is compromised or misused.

Context-Inappropriate Capability

High
Confidence
92% confidence
Finding
The add, edit, and delete methods expose direct remote state-changing operations without any visible restriction on target endpoint or operation type. In a skill whose stated role is analysis and reporting, this creates unjustified write/delete capability that could be used to tamper with backend data or trigger destructive actions if invoked with attacker-controlled parameters.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The http_post, http_put, http_get, and http_delete methods provide a general outbound network client abstraction that can contact arbitrary URLs through RequestUtil. In the context of a specialized behavioral analysis skill, this unnecessary flexibility increases the chance of data exfiltration, unauthorized service interaction, or capability expansion beyond the declared scope.

Description-Behavior Mismatch

High
Confidence
89% confidence
Finding
The file implements a generic local database/DAO layer with user and token handling that is unrelated to the declared autism video-analysis purpose. Capability mismatch increases the risk that the skill collects, stores, or persists data beyond user expectations, which is especially concerning in a child-health context.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The model stores usernames, real names, email, birthdays, tokens, and open tokens, none of which are justified by a behavioral video-analysis tool for children. In this skill context, unnecessary identity and token storage raises privacy, compliance, and account-compromise risks because sensitive child- or guardian-linked data may be retained locally without clear need.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The file defines a general-purpose `ai_chat` capability that is unrelated to the stated autism video behavior analysis purpose. Even though the subprocess call is currently commented out and the method is broken, this kind of latent agent-execution interface expands the skill's scope and can later be enabled to invoke arbitrary external AI tooling, creating unnecessary attack surface and policy bypass risk.

Intent-Code Divergence

Medium
Confidence
76% confidence
Finding
The docstring states that the function invokes `openclaw agent` via subprocess, while the implementation does not actually do so because the command construction and execution are commented out. This inconsistency is dangerous because it obscures the true behavior of the skill, hinders code review, and may conceal dormant or partially removed execution logic that could later be reactivated without proper scrutiny.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This code automatically provisions or retrieves user identities, obtains tokens from a remote service, and persists them locally, despite the skill's stated purpose being autism video analysis. That creates hidden authentication state and unnecessary credential handling, which can expose users to account misuse, silent enrollment, and unintended linkage between local workspace identity and remote services.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The utility reads workspace-scoped identity material from data/smyx-api-key.txt and creates default local user records when none exist, all without any clear relationship to autism analysis. This introduces covert identity bootstrapping and persistence, which can surprise users, weaken consent boundaries, and create a local trail of identifiers that other code may reuse for network actions.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
This code performs generic workspace discovery and creates data/skills directories under the detected workspace. While not directly malicious, it expands the skill's capability beyond its declared purpose and gives it broader filesystem awareness and write access than a video-analysis skill would normally need, increasing the blast radius if combined with other unsafe behavior.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-report auto-trigger phrases are broad enough that ordinary conversational requests like asking to 'view history reports' may automatically invoke a cloud API and retrieve sensitive prior reports. In this skill's context, those reports concern children's behavioral health screening, so ambiguous triggering raises the risk of privacy-impacting actions without sufficiently explicit user intent.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill processes children's videos and queries cloud-stored behavioral analysis history, but the description does not clearly warn users that highly sensitive child health-related media and derived reports may be uploaded, stored, and retrieved from remote services. In this context, missing privacy disclosures are particularly serious because the data involves minors and potential health inferences, which can lead to legal, ethical, and confidentiality harms if mishandled.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code submits local video paths or remote URLs to an external analysis service through skill.get_output_analysis without any clear user-facing notice that sensitive child behavioral video data may leave the local environment. Because this concerns pediatric health-related content, lack of disclosure materially increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script sends video input for analysis via `skill.get_output_analysis(...)` after accepting either a local file path or remote URL, but it does not present any explicit user-facing disclosure or consent step indicating that sensitive video data may be transmitted to a backend service. In this skill’s context, the videos concern children and autism-related behavioral analysis, which makes the data especially sensitive; silent transmission can create privacy, compliance, and trust risks even if the backend is legitimate.

Missing User Warnings

Low
Confidence
78% confidence
Finding
YamlUtil.load will create a missing configuration file and silently populate it with defaults, which mutates the filesystem during what appears to be a read operation. In a security-sensitive or multi-tenant environment, silent file creation can hide misconfiguration, create unintended artifacts, and weaken auditability, especially because exceptions are swallowed.

Missing User Warnings

Low
Confidence
87% confidence
Finding
YamlUtil.save overwrites the target file unconditionally and suppresses all exceptions, which can silently destroy configuration state or mask failed writes. If an attacker can influence the path or surrounding filesystem state elsewhere in the application, this pattern increases the risk of clobbering important files without detection.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads a sensitive identifier from a workspace file (data/smyx-api-key.txt) without any user-facing disclosure or consent flow. Even if intended for convenience, silently ingesting identity material can lead to unexpected impersonation, data mixing across tasks, and use of secrets the user did not intend this skill to access.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The helper silently performs a network login/registration request using openId/mobile/source fields derived from local identity state. This is dangerous because it transmits identifying information to an external endpoint and may create or activate remote accounts without the user's knowledge, which is especially unjustified for a medical/behavioral analysis skill.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The general HTTP helper automatically attaches tokens, API keys, tenant metadata, and user identifiers to outbound requests with no visible disclosure boundary. This creates a broad exfiltration surface where any caller using the helper may unintentionally send sensitive account context to remote services, and in debug mode request details may also be exposed in logs.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
## ⚠️ 注意事项 | Notes
| 分类 | 注意事项 |
|---|---|
| 🧑‍⚖️ 结果性质 | **重要声明**:本分析仅供早期筛查参考,不能替代专业医生诊断或临床评估。明确疑似孤独症请尽早转诊专业医疗机构 |
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
Confidence
78% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2