Child Drowsiness / Fatigue Detection | 儿童打瞌睡/疲劳检测

• Outcome: Review
• Latest audit: Aug 28, 2026 · 11:19 PM UTC
• Version: 1.0.8

Overview

This skill handles sensitive child video through a remote service while silently creating or reusing identity records and storing service tokens locally.

Install only if you are comfortable sending children's face videos or video URLs to the publisher's cloud service, having historical reports queried from that service, and having local identity/token records created in the workspace. Use it only with guardian consent and avoid shared workspaces unless identity and report access are clearly isolated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 67% confidence
• Finding: This query builder applies filters using attribute names taken directly from the caller's filters dictionary without any allowlist. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still probe model structure, trigger exceptions for invalid fields, and query on sensitive columns that the API may not have intended to expose.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 65% confidence
• Finding: Like the list() method, count() accepts arbitrary filter keys and maps them to model attributes dynamically. This can enable unintended querying of protected fields, schema probing, and denial-of-service through repeated invalid-field errors if external input reaches this method.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no explicit permissions, yet the documentation clearly instructs use of shell execution, network access, and local file read/write behaviors. This mismatch weakens trust boundaries and can cause the agent or reviewer to underestimate the skill’s effective capabilities, especially given child-video inputs and cloud interactions.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest presents a real-time fatigue-analysis skill, but the workflow also adds cloud history-report retrieval and report-link return behavior that is not clearly scoped in the top-level description. This scope expansion matters because it introduces remote data access and historical data exposure, including potentially sensitive records about minors.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: Automatic saving of uploaded attachments to local storage expands data handling beyond what users may infer from a fatigue-analysis skill. Because the data concerns children’s videos, silent local persistence increases privacy and retention risk if files are stored insecurely or longer than necessary.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation describes automatic creation and reuse of a local default user identity when no upstream identity is provided. For a skill processing minors’ sensitive video-derived reports, silently assigning a default identity risks cross-user data mixing, unintended report access, and weak auditability.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The skill says it must not provide medical or sleep-disorder diagnosis, yet the trigger list includes requests for 'sleep health diagnosis report' queries. This contradiction can mislead users into treating the system as a diagnostic tool and can cause inappropriate handling of sensitive health-like information about children.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script supports listing prior analysis records for a hidden `open_id` and resolves identity through `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))`, which suggests a caller may supply an arbitrary identifier. In a child-fatigue monitoring context, analysis history is likely sensitive behavioral/biometric metadata, so insecure direct object reference or weak authorization here could expose another child's records.

Context-Inappropriate Capability

Medium

• Confidence: 73% confidence
• Finding: The `--list` path exposes `skill.get_output_analysis_list(open_id=open_id)`, enabling enumeration of historical analysis records even though the manifest only describes real-time fatigue detection. In a child-video context, access to historical records can reveal sensitive biometric/behavioral data, and the script shows no local authorization, scope restriction, or purpose limitation before retrieving that history.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as classroom/home child fatigue detection, but the shared DAO defines and manages persistent user account records with identity fields. That is a major scope mismatch and indicates unnecessary collection and retention of personal data, which increases privacy, compliance, and cross-feature abuse risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores authentication and identity-related fields including username, realname, email, token, and open_token, which are not justified by a narrow drowsiness-analysis use case for children. In this context, collecting and persisting these fields materially raises the sensitivity of the skill and the harm from compromise or misuse.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote login/registration, token retrieval, and authenticated API request handling that are unrelated to a local child-fatigue detection function. In this context, the code silently establishes remote identity and network access capabilities, which expands the skill's privilege and data exposure surface far beyond what users would reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code resolves or creates default open-id identities, reads identity from a workspace file, and persists user records locally without an obvious user-facing need for fatigue detection. For a child-monitoring skill, silently creating and reusing identities is especially sensitive because it can enable tracking, account linkage, and undisclosed backend interactions.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: Although the code comments claim safer logging, debug/error paths still print request data, response text, and header-related context. If those payloads contain tokens, usernames, child-related metadata, or backend error details, enabling debug mode could leak sensitive information into logs or consoles.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default trigger is broad enough to activate on essentially any child-face study video or file needing analysis, without requiring strong confirmation of user intent. Over-broad auto-triggering is risky here because the skill handles sensitive media of minors and may initiate analysis or related data operations unexpectedly.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The keyword trigger list includes ambiguous phrases such as normal educational discussion terms, increasing the chance of accidental activation. In a skill dealing with minors’ biometric-like facial analysis and history lookup, unintended invocation can expose or process sensitive data beyond what the user meant.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: This code uploads local video content or forwards a remote video URL to an analysis service without any visible consent, warning, or minimization controls in the skill layer. Because the subject is children's facial video, the privacy sensitivity is high, and silent transmission can lead to unintended collection or processing of highly sensitive biometric and behavioral data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code reads an identity value from data/smyx-api-key.txt and treats it as an internal identity source without any visible disclosure or consent flow. In a skill handling children’s video-derived state, undisclosed identity binding increases privacy risk and can tie local usage to remote accounts unexpectedly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This login/registration flow assembles user identity data and transmits it to a remote endpoint silently, including openId/mobile-like fields and source metadata. For a classroom/home child-fatigue skill, such undisclosed account creation and identity transmission is materially more dangerous because users would expect local analytics, not background identity enrollment.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 92% confidence
• Finding: The requests.post call sends identity-bearing data to an external service. External transmission is not inherently malicious, but in this skill context it is under-justified and privacy-sensitive because the advertised purpose is fatigue detection from local video, not remote identity registration.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2