Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent child focus-analysis purpose, but it should be reviewed carefully because it sends minor-related video/report data to cloud APIs and persists local identity/authentication state.
Install only if you are comfortable sending child study-area videos or URLs to the configured lifeemergence/open.lifeemergence cloud services and having cloud reports tied to a silently managed local identity. Verify guardian/school consent, account separation, report access controls, token storage protections, retention/deletion terms, and whether historical reports can be exported or revoked.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
The finding indicates external API communication, user/account creation, filesystem discovery/creation, and local identity persistence that are not central to the public-facing description. In a child-monitoring context, these hidden identity and storage operations increase the chance of unauthorized profiling, retention, or leakage of sensitive data.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-child-focus-analysis-analysis"
description: "Using the camera built into a smart desk lamp or a tabletop camera, the system analyzes video of the child's study area in real time, detecting behavioral indicators such as face orientation (whether it deviates from the book/screen), eye gaze direction, and fidgeting hand actions (playing with a pen, touching the face, fiddling with objects), and computes a per-minute focus score (0-100) while recording distraction periods. The skill helps parents and teachers understand the child's learning state and optimize study habits. Application scenarios: smart study lamps, home study ro
The model persists token and open_token values for a child focus-analysis skill without any clear functional need, and the code provides generic save/update paths that can store them in a local SQLite database. Authentication tokens are high-value secrets; if the workstation, shared workspace, or database file is accessed by another process or user, those tokens could be stolen and used to impersonate accounts or call external services.
This utility silently provisions user identities through a remote login endpoint, retrieves tokens, and persists them locally in a database for reuse. That behavior is unrelated to a child focus video-analysis skill and creates an undisclosed authentication/identity side channel that can enroll users, associate actions with fabricated identities, and expand the skill's access beyond its stated purpose.
The skill declares capabilities that imply shell, network, file, and environment access through referenced scripts, but it does not define any explicit tool-scope restrictions such as allowed tools or permissions. In a skill that handles child-study videos and historical reports, this lack of least-privilege boundaries increases the risk of unintended file access, command execution, or data exfiltration if the skill is invoked in a broader agent runtime.
The AI role says only visual focus indicators and distraction statistics will be output, but other sections promise suggestions and report links. Contradictory output contracts are risky because they can enable unanticipated disclosure of links, recommendations, or extra data in a sensitive child-monitoring workflow.
The default trigger is broad enough to invoke the skill for generic study-area video analysis requests, which can cause unintended processing of sensitive videos. In this context, accidental invocation matters because the content involves minors and may be uploaded or analyzed remotely without sufficiently specific user intent.
The skill presents itself as visual focus analysis but also includes cloud historical-report retrieval and report-link output outside that core scope. Scope expansion matters here because it increases access to previously collected child-related records and may expose more data than a user expects from a one-off analysis request.
The history-report auto-trigger relies on broad natural-language phrases and can activate cloud report retrieval without a narrowly scoped request. That creates a risk of exposing prior child-behavior reports when the user may only be asking general questions about history or records.
The API documentation describes processing children's camera/video data, behavioral monitoring, and full report export without any privacy, consent, retention, access-control, or export-handling safeguards. Because the subject matter is surveillance and profiling of children, missing security and privacy warnings materially increase the risk of unauthorized collection, disclosure, and misuse of highly sensitive personal data.
The method returns a fixed Chinese string for user-facing output, which enforces a specific language choice in the skill behavior. The file does not show any user language selection, fallback, or documented region-specific justification for this locale constraint.
The manifest describes a system for analyzing a child's study behavior, yet the code accepts pet_type and offers cat, dog, and other as user-facing choices. This indicates the implementation was repurposed from a pet-analysis skill and does not cleanly match the declared behavior and domain of the manifest.
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) without clear user-facing disclosure or consent. In a child-monitoring context, silently binding analysis and history retrieval to an internal identity increases privacy risk, can cause records to be associated with the wrong user, and may expose sensitive behavioral data through --list operations.
Detected: suspicious.install_untrusted_source