Security audit

Child Dangerous Object Contact Detection | 儿童接触危险物品识别

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent child-safety analysis purpose, but it silently creates or reuses identities, stores tokens locally, and queries cloud history for sensitive child video reports without enough user-facing control or disclosure.

Review this skill before installing in any real home, school, or childcare setting. It may upload child video or video URLs to a remote service, retrieve historical cloud reports, create or reuse a local identity, and store authentication tokens in a workspace SQLite database. Install only if the publisher is trusted, the endpoint configuration is understood, and guardians or administrators have consented to cloud processing and report retention.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 79% confidence
Finding: The list() method applies filters using getattr(self.__model__, key) where key comes from the caller. Although SQLAlchemy prevents classic SQL injection here, unvalidated dynamic field selection can let callers query on unintended columns, bypass business rules, or trigger errors/attribute probing that exposes internal model structure. In a skill already storing usernames, real names, email, and tokens, this broad query surface increases privacy risk.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 77% confidence
Finding: The count() method repeats the same unvalidated dynamic attribute lookup for caller-supplied filter keys. This can enable enumeration of records across sensitive fields and may aid data discovery or access-control bypass if external inputs reach this method.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions while its documented and inferred behavior includes shell execution, file read/write, environment access, and network communication. This under-disclosure is dangerous because users and reviewers cannot accurately assess the trust boundary, especially for a skill that processes sensitive child video and can persist local state or transmit data remotely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose presents a real-time child-safety monitoring feature, but the behavior includes creating persistent local identities, contacting backend auth endpoints, retrieving historical cloud reports, and exposing report links. This mismatch is dangerous because it hides collection, persistence, and remote account activity behind a safety-focused description, which can mislead operators into authorizing sensitive child-video workflows without informed consent or proper controls.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill expands from on-device/video analysis into cloud-hosted historical report querying and report-link retrieval, introducing additional data exposure paths not implied by the core safety use case. In the context of child monitoring, this is particularly sensitive because historical reports and linked images may reveal private household activity and minors' images over time.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The script exposes an --export-env-only flag that explicitly promises not to execute analysis, but the control flow never checks it and will still analyze user-supplied input. In a security-sensitive home-monitoring context, this can cause unintended processing of local or remote video data, violating operator expectations and potentially triggering privacy-impacting networked analysis when the user believed execution was suppressed.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill accepts arbitrary http/https video URLs and forwards them for analysis, which expands the capability from fixed in-home camera monitoring to analysis of any remotely hosted video. This can enable unauthorized processing of external or sensitive footage and broadens the data-ingestion surface beyond the declared purpose, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The report listing function exposes historical analysis results that are not necessary for the stated real-time dangerous-object detection workflow. Without strong access controls and scope checks, this creates a data exposure path where prior reports and associated metadata may be enumerated or retrieved by unauthorized users.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: The CLI exposes history enumeration by `open_id` via `show_analyze_list`, which is unrelated to the stated child-safety detection purpose and could enable unauthorized access to prior analysis records if `open_id` handling is weak upstream. In a home-camera context, analysis history can reveal sensitive behavioral and household surveillance data, making this capability privacy-relevant even if hidden from `--help`.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This service exposes broad generic network capabilities—arbitrary page/list/add/edit/delete and raw HTTP GET/POST/PUT/DELETE helpers—that are far wider than the skill’s declared purpose of dangerous-object video analysis and alerting. In a skill handling home camera contexts, unnecessary general-purpose API primitives increase the attack surface for unauthorized data access, data exfiltration, or unintended backend actions if other components can invoke them with attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The ability to look up users by username is not justified by the stated functionality of detecting dangerous objects and warning caregivers. In a home-monitoring skill, this kind of account-enumeration or identity lookup capability can facilitate privacy leakage or support lateral misuse against user accounts unrelated to the core safety feature.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This file defines generic user-account persistence, lookup, update, and token-bearing storage that materially exceeds the manifest's stated purpose of child dangerous-object video analysis and alerting. Such out-of-scope identity and account handling expands the attack surface and creates unnecessary collection of personal and credential-like data in a safety-monitoring skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The User model stores identity fields and sensitive token/open_token values even though the skill description is limited to real-time child safety detection from home cameras. In this context, collecting and persisting credential-like tokens is especially risky because the deployment environment is a home-monitoring system involving children, making privacy expectations higher and any compromise more harmful.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This utility code creates or reuses user identities, performs silent remote registration/login, and persists tokens locally, which is unrelated to a child dangerous-object detection skill. That broad identity bootstrapping increases the attack surface for unauthorized account creation, token misuse, hidden network activity, and cross-skill tracking of users or devices.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code derives identity from workspace environment variables and a local credential-like file (data/smyx-api-key.txt), then uses that identity as a fallback current user. For a child-safety video analysis skill, this is unnecessary privilege expansion and can lead to identity confusion, unintended account linkage, and use of local secrets without clear authorization boundaries.

External Transmission

Medium

Category: Data Exfiltration
Content: "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"):
Confidence: 91% confidence
Finding: The code sends identity-related data (openId/mobile/source) to an external endpoint for silent phoneLogin/registration. In the context of a home child-danger detection skill, undisclosed outbound transmission of identifiers is especially sensitive because it can enable remote account correlation and data flow beyond the stated safety function.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2