Security audit

Child Focus / Distraction Period Analysis | 儿童专注度与走神时段分析

Security checks across malware telemetry and agentic risk

Overview

The skill matches its stated child-video analysis purpose, but it ships unsafe defaults for sensitive minor data, including unencrypted private-network API endpoints and local plaintext credential persistence.

Review before installing. This should not be used for children's videos unless the publisher removes the packaged dev HTTP endpoints, enforces HTTPS to approved public services, documents upload destination/retention/deletion, requires explicit guardian/admin consent before processing, stops silent account creation, protects or avoids persisted bearer tokens, and fixes the dependency name.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/config-dev.yaml:2
Finding: Minors' Video Data and Authentication Credentials Are Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:15`; `skills/smyx_common/scripts/config-dev.yaml:2-4`; `skills/smyx_analysis/scripts/skill.py:113-128`; `skills/smyx_common/scripts/util.py:548-561, 610-646` **Vulnerability Type**: Plaintext transmission of sensitive data **Risk Level**: Critical ### Vulnerable Code The default configuration activates the development environment: ```yaml # skills/smyx_common/scripts/config.yaml:15 env: dev ``` The selected development configuration replaces the public HTTPS endpoints with private-network HTTP endpoints: ```yaml # skills/smyx_common/scripts/config-dev.yaml:1-7 ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` Local child-monitoring files are read and prepared for upload: ```python # skills/smyx_analysis/scripts/skill.py:113-128 if (input_path.startswith("http://") or input_path.startswith("https://")): params.update({ "videoUrl": input_path }) else: _validate_file(input_path) # Automatically detect the MIME type mime_type, _ = mimetypes.guess_type(input_path) if mime_type is None: mime_type = 'application/octet-stream' # Read the file content with open(input_path, 'rb') as f: file_content = f.read() files = { 'file': (os.path.basename(input_path), file_content, mime_type) } ``` Identity registration is performed against the configured health endpoint: ```python # skills/smyx_common/scripts/util.py:548-561 def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = reques ...[truncated 3674 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `env: dev` from all production and distributable Skill packages. 2. Require HTTPS for every authentication, upload, polling, history, and report endpoint. 3. Reject endpoints whose scheme is not `https`. 4. Apply an explicit allowlist of approved API origins instead of accepting arbitrary absolute URLs. 5. Block private, loopback, link-local, and metadata-service destinations unless a separately secured development mode is explicitly enabled. 6. Keep development configuration outside the released package or require an explicit development-only environment variable. 7. Use valid certificate verification and do not permit TLS verification to be disabled. 8. Rotate any credentials that may already have traversed the plaintext endpoints. 9. Obtain explicit informed consent before uploading recordings of minors, and document the destination, retention period, and deletion policy. 10. Minimize uploaded content where possible, such as extracting only necessary frames or features locally. 11. Add automated tests that fail when an active endpoint uses HTTP or resolves to an unapproved private address. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/dao.py:460
Finding: Reusable Authentication Tokens Are Stored Unencrypted in a Shared Workspace Database<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:586-602`; `skills/smyx_common/scripts/dao.py:155-167, 460-461` **Vulnerability Type**: Insecure local credential storage **Risk Level**: High ### Vulnerable Code Authentication tokens returned by the remote service are copied into a user model and persisted: ```python # skills/smyx_common/scripts/util.py:586-602 ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` The database is an ordinary workspace-shared SQLite file without encryption or explicit restrictive permissions: ```python # skills/smyx_common/scripts/dao.py:155-167 def __init__(self, db_path: str = None): """ Initialize the DAO. """ if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) self.SessionLocal = sessionmaker( autocommit=False, autoflush=False, bind=self.engine ) self._create_tables() self._alter_tables() ``` The user table stores the tokens directly as plaintext string columns: ```python # skills/smyx_common/scripts/dao.py:460-461 token = Column(String(500), comment="token") open_token = Column(String(1000), comment="open token") ` ...[truncated 2171 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Store reusable tokens in an operating-system keychain, hardware-backed keystore, or dedicated encrypted secret manager. 2. If file-based storage is unavoidable, encrypt credentials with a key that is not stored beside the database. 3. Create the data directory and database with owner-only permissions, such as `0700` for directories and `0600` for files. 4. Do not share credential databases between unrelated Skills or agent workspaces. 5. Prefer short-lived, narrowly scoped access tokens and refresh them only when required. 6. Avoid persisting tokens when an in-memory session is sufficient. 7. Retain only a non-secret local identity mapping for report association. 8. Implement explicit token expiration, revocation, logout, and secure deletion behavior. 9. Rotate credentials after migration because existing database copies may already contain exposed tokens. 10. Add tests verifying database permissions and ensuring secrets are not serialized into general-purpose workspace storage. ]]>

T08 · Insecure Dependencies

Warning

Location: skills/smyx_analysis/requirements.txt:3
Finding: Incorrect YAML Dependency Name Creates Dependency-Confusion Risk<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_analysis/requirements.txt:3` **Vulnerability Type**: Dependency confusion or unintended package installation **Risk Level**: Medium ### Vulnerable Code ```text # skills/smyx_analysis/requirements.txt:1-3 pydash==8.0.6 SQLAlchemy==2.0.46 yaml==6.0.3 ``` The sibling common module uses the expected distribution name: ```text # skills/smyx_common/requirements.txt:1-3 pydash==8.0.6 SQLAlchemy==2.0.46 PyYAML==6.0.3 ``` ### Technical Analysis The source code imports the Python module as `yaml`, but the standard package distribution that provides this module is named `PyYAML`. The analysis requirements file requests a distribution named `yaml`, while the sibling requirements file correctly requests `PyYAML`. Python import names and package-index distribution names are not interchangeable. Requesting a similarly named distribution can cause installation failure or resolve to an unintended package from the configured package index. Package installation may execute build-system or setup code, making an incorrect package name a supply-chain security concern. The version is pinned, which limits version drift, but no package hashes or trusted-index restrictions are present in the reviewed manifest. ### Attack Path 1. An administrator or automated deployment process installs `skills/smyx_analysis/requirements.txt`. 2. The package resolver requests the distribution `yaml==6.0.3`, rather than `PyYAML==6.0.3`. 3. If that name and version are available on the configured public or internal index, the resolver downloads the unintended distribution. 4. The package's build or installation hooks execute with the privileges of the installation process. 5. A malicious or compromised package can access files, environment variables, credentials, or network resources available to that process. 6. If no matching distribution exists, deployment fails, creating an availability and integrity issue rather than code exec ...[truncated 631 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the incorrect entry with: ```text PyYAML==6.0.3 ``` 2. Consolidate shared dependencies so the analysis and common modules cannot declare conflicting package names. 3. Generate a locked dependency file with cryptographic hashes. 4. Install packages only from an explicitly trusted package index. 5. Use `--require-hashes` or an equivalent package-manager integrity mode in automated builds. 6. Scan resolved dependency names for typosquatting and dependency-confusion patterns. 7. Build and install dependencies in an isolated, non-privileged environment with restricted network and filesystem access. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises no permissions, yet the documentation clearly directs use of local files, shell execution, networking, and persistent storage behaviors. This permission under-declaration prevents accurate risk evaluation and user consent, especially because the skill processes sensitive child video data and interacts with remote services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is child focus analysis, but the behavior expands into account creation/login, local identity persistence, cloud history retrieval, and remote report-link generation. This is dangerous because it hides materially different data flows and backend actions from users, including transfer and retention of minors' data, making informed consent and security review impossible.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The documentation broadens the skill from local real-time analysis into cloud history lookup and report retrieval, which materially changes the trust boundary and data lifecycle. In a child-monitoring context, undisclosed cloud-side storage and retrieval of historical records raises privacy and abuse risks.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: Automatic identity initialization and default-user creation are hidden stateful behaviors unrelated to the apparent task of video focus scoring. This creates silent identity binding and persistence for a minor-focused monitoring skill, increasing the risk of cross-session tracking, unintended account reuse, and unauthorized data association.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Creating a local default user without explicit user action is unjustified for this use case and can silently accumulate child-related records under a persistent identifier. That makes later report retrieval, correlation, or accidental disclosure much easier, especially on shared systems.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI includes a hidden `--list` mode that retrieves analysis records for an internal user identifier, which goes beyond the advertised per-video focus analysis behavior. Hidden record-enumeration functionality increases the risk of unauthorized access to historical child-monitoring data, especially because it is tied to internal identity handling and is not transparently documented to users.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script resolves and uses an internal `open_id` via `OpenIdUtil.resolve_current_open_id(...)` and then uses `ConstantEnum.CURRENT__OPEN_ID` to fetch analysis lists, even though the stated purpose is local/video focus analysis. In a child-monitoring context, tying analysis history access to an internal identifier without clear consent, purpose limitation, and visible access controls creates privacy and data-exposure risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill accepts arbitrary remote video URLs even though its stated purpose is local camera-based child study monitoring. This broadens the data ingestion surface and can enable misuse such as analyzing unrelated third-party content, pulling sensitive internal resources if the backend fetches URLs, or bypassing expected consent boundaries for child-focused monitoring.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: This skill is described as child focus analysis, but the file defines a generic user DAO that persists identity records, profile data, and authentication-like tokens. That creates unjustified collection and mutation of user account data outside the stated purpose, increasing privacy exposure and expanding the blast radius if the local database is accessed or reused across skills.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The User model stores sensitive fields including token, open_token, email, birthday, age, and realname without any visible protection, while the manifest does not justify handling authentication tokens at all. In the context of a child-monitoring skill, unnecessary storage of personal and authentication-related data is especially dangerous because it can expose minors' data and reusable credentials if the SQLite database is copied, shared, or queried by other components.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The implemented skill does not perform the manifest-declared child-focus video analysis and instead exposes a generic `ai_chat` capability. This is dangerous because it creates a strong mismatch between declared purpose and actual behavior, which can conceal unauthorized LLM/agent functionality, expand the attack surface, and undermine trust, review, and policy enforcement for a child-monitoring skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The utility can silently provision or reuse identities, obtain tokens, and persist them locally while interacting with external services. For a child-focus video-analysis skill whose described behavior is local behavior scoring/alerting, this is an unjustified expansion of data handling that can link child activity to remote accounts and enable unauthorized service access under implicit identities.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This request wrapper performs broad outbound API access, injects tenant and user identifiers, and attaches authentication headers independent of the declared child-focus analysis function. In context, this creates unnecessary exfiltration and account-coupling risk because a video-monitoring skill for children should not include generic remote API plumbing unless clearly disclosed and narrowly justified.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code reads a local API-key-related file and reuses its contents as an internal identity value without clear user action. In this skill context, that silently binds operation to a preexisting identity, increasing the risk of cross-user tracking, unintended account usage, and hidden remote correlation of child-monitoring activity.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: An overly broad default trigger can cause the skill to activate on generic video-analysis requests and send files or URLs into a child-monitoring workflow unexpectedly. Because the skill may perform cloud processing and identity-linked storage, mistaken activation increases privacy exposure and unintended data handling.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill handles children's video and reports but does not clearly warn users that data may be transmitted to remote services and stored for later history queries. In a minors' privacy context, this omission is particularly dangerous because users may assume local-only processing while sensitive footage becomes remotely accessible or retained.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation defines APIs for camera-based monitoring of children, focus scoring, distraction event tracking, historical record retrieval, and full report export, but provides no privacy, consent, retention, access control, or secure handling guidance for this highly sensitive child behavioral data. In the context of surveillance of minors, this omission materially increases the risk of unauthorized collection, over-retention, misuse, or exposure of regulated personal data, especially via history and export endpoints.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code reads arbitrary local video files into memory and submits them to an external analysis service, but this file contains no user-facing consent, disclosure, or confirmation step. In the context of a child-focus monitoring skill processing potentially sensitive videos of minors, silent exfiltration of local content to a remote service creates a significant privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: In debug mode, the code logs request parameters, data, and successful/failed response bodies. Because this utility also handles tokens, usernames, tenant codes, and potentially behavior-analysis payloads, logs can expose sensitive operational and user data without notice, which is especially concerning in a child-monitoring context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The utility generates and persists a default user identity automatically when none exists, without any user-facing disclosure or approval. In a skill analyzing children, silent identity creation is privacy-invasive because it establishes a persistent identifier that can be reused across sessions and potentially linked to remote services.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code performs an implicit registration/login request to an external service using a generated or reused identifier, without user-facing warning. This is dangerous because it silently transmits identity-linked data off-device and can create remote accounts for a child-focused monitoring feature that users may reasonably expect to operate locally.

External Transmission

Medium

Category: Data Exfiltration
Content: "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"):
Confidence: 94% confidence
Finding: This outbound POST sends identity-related data to an external endpoint as part of silent login/registration flow. External transmission is particularly sensitive here because the skill concerns children's study behavior, so unjustified remote communication increases privacy and compliance risk even if the payload is not raw video.

Hidden Instructions

High

Category: Prompt Injection
Content: |---|---| | 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 | | 📁 格式支持 | 输入要求：支持 mp4/avi/mov 视频，最大 10MB；建议正对面部 + 学习区域 | | 🧑‍⚖️ 结果性质 | 专注度评分仅作为学习行为辅助参考，本工具不替代家长/教师的实际观察与教育判断 | | 🔏 隐私合规 | 隐私合规：儿童学习场景视频涉及未成年人隐私，使用前需取得监护人知情同意，并妥善保管/加密相关录像 | | 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 | | 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence: 78% confidence
Finding: The hidden or non-printing instruction content and imperative operational directives can be used to steer agent behavior in ways not obvious during review. In this skill, such hidden guidance is concerning because it influences how sensitive child video data and remote resources are handled while reducing transparency to auditors and users.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: --- name: "smyx-child-focus-analysis-analysis" description: "Using the camera built into a smart desk lamp or a tabletop camera, the system analyzes video of the child's study area in real time, detecting behavioral indicators such as face orientation (whether it deviates from the book/screen), eye gaze direction, and fidgeting hand actions (playing with a pen, touching the face, fiddling with objects), and computes a per-minute focus score (0-100) while recording distraction periods. The skill helps parents and teachers understand the child's learning state and optimize study habits. Application scenarios: smart study lamps, home study rooms, classrooms. The system monitors in real time, generates focus reports, and pushes alerts when focus stays persistently low. Skill features: improve learning efficiency. | 通过智能台灯内置摄像头或桌面摄像头，实时分析儿童学习区域的视频，检测面部朝向（是否偏离书本/屏幕）、眼部注视方向、手部小动作（玩笔、摸脸、摆弄物品）等行为指标，计算每分钟专注得分（0-100分），并记录走神时段。该技能可帮助家长和教师了解儿童学习状态，优化学习习惯。应用场景：智能学习台灯、家庭书房、教室。系统实时监测，生成专注度报告，当专注度持续偏低时推送提醒。技能特点：提升学习效率。" version: "1.0.15" license: "MIT-0" ---
Confidence: 85% confidence
Finding: The manifest shows metadata-poisoning indicators and mixes descriptive content with agent-steering structure in a way that can manipulate tool interpretation and trust decisions. In an agent-executed skill handling minors' data, poisoned metadata can obscure true capabilities, suppress scrutiny, or induce unsafe processing paths.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2