ClawHub
Back to skill

Security audit

Child Restless Sleep / Nightmare Detection | 儿童睡眠中频繁翻身/噩梦识别

Security checks across malware telemetry and agentic risk

Overview

This child sleep-analysis skill has a coherent purpose, but it sends very sensitive child audio/video data through cloud APIs while silently creating or reusing local identities and storing tokens.

Review before installing. Only use this with clear guardian consent, trusted endpoints, and non-sensitive test data first. Confirm the package is configured for the intended production HTTPS service rather than the bundled dev/private HTTP addresses, and understand that it may create a local account record, store tokens in the workspace data database, and associate uploaded child sleep recordings or report history with that identity.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
80% confidence
Finding
This getattr(self.__model__, key) uses keys from the caller-supplied filters dict to select model attributes dynamically. While SQLAlchemy parameterizes values and prevents classic SQL injection, unvalidated field selection can expose unintended columns, trigger exceptions, and enable unauthorized querying against sensitive fields like token/open_token in a general-purpose user store that is unrelated to the sleep-monitoring manifest.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
As in list(), count() dynamically resolves model attributes from caller-controlled filter keys without validation. This can facilitate schema probing, querying on sensitive columns, and instability through unexpected attribute access, which is more concerning because the same module stores account and token data outside the stated child sleep-analysis purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions while its documented behavior includes shell execution, network access, local file handling, and environment use. This undermines least-privilege review and prevents users or hosting platforms from accurately assessing what the skill can access before execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is presented as a child sleep-analysis tool, but the described implementation also manages local identities, contacts remote account/login services, persists tokens, and exposes historical report URLs. In a child-bedroom monitoring context involving sensitive minors' audio/video, these extra behaviors materially expand data collection and sharing beyond user expectations and increase privacy and account-risk exposure.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Cloud-based historical report lookup is a secondary data-access function beyond one-time sleep analysis and can expose previously collected reports, links, and metadata. Because the subject matter is children's bedroom audio/video, this scope expansion increases privacy sensitivity and the consequences of unauthorized or excessive retrieval.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Automatic reuse or creation of a default local user introduces hidden identity state not justified by the core sleep-monitoring function. This can cause cross-user data mixing, silent account association, and unintended access to prior reports or tokens, which is especially dangerous for sensitive recordings of minors.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill accepts any http/https URL as a video source without restricting it to a trusted bedroom camera origin, despite the stated use case being a fixed child-room monitor. In this context, arbitrary remote URLs can cause unauthorized ingestion of third-party media, SSRF-style access to internal resources if backend fetches the URL, or analysis of non-consensual child video/audio sources, which is especially sensitive given the child surveillance and audio-processing purpose.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The function accepts arbitrary remote URLs and forwards them for analysis, even though the declared use case is a fixed in-room child-monitoring camera. In a privacy-sensitive child-bedroom context, this undocumented input surface can enable analysis of unrelated third-party videos, server-side fetching of attacker-controlled URLs, or policy bypass if downstream components retrieve the content without strict validation.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements a broad, generic API client with download, paging, CRUD, and arbitrary HTTP methods that materially exceeds the narrowly described sleep-monitoring behavior. In a child bedroom monitoring skill handling sensitive audio/video-related data, unexplained remote access primitives enlarge the attack surface and enable undocumented data flows or backend actions if other components pass attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The exposed http_post/http_put/http_get/http_delete and generic add/edit/delete methods support arbitrary remote resource access and mutation with little visible restriction in this layer. For a skill intended to analyze a child's sleep, that capability is disproportionate and dangerous because it could be repurposed to exfiltrate sensitive monitoring data, call unintended services, or modify remote state outside the declared feature set.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The file defines persistent local user/account storage and retrieval behavior that does not map to the manifest's described functionality of detecting rollovers, crying, and sleep talk. Scope divergence is a security concern because unnecessary identity persistence increases attack surface, enables collection of extra personal data, and can hide undeclared secondary behavior in a child-monitoring context.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This DAO layer supports broad create/update/delete operations and even schema alteration, which materially exceeds the analytics/reporting scope described for nightmare or restless-sleep detection. In a child-bedroom monitoring skill, unnecessary local mutation capability raises the risk of covert persistence, retention of sensitive behavioral data, and misuse beyond the user's reasonable expectations.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores general-purpose profile and credential-like fields including token and open_token, which are not justified by the manifest for child sleep monitoring. In this context, undeclared token storage is especially sensitive because it can facilitate account linkage, persistent tracking, or credential exposure alongside highly private bedroom audio/video-derived data about a child.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file adds a generic `ai_chat(prompt, session_id, timeout)` interface that is unrelated to the declared child sleep-monitoring function. Exposing a broad prompt-driven agent surface inside a bedroom-monitoring skill increases the attack surface and creates a capability mismatch: other components could route arbitrary prompts or sensitive room-derived data into an LLM/agent pathway not justified by the manifest.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility layer performs unrelated external login/registration and token persistence despite the skill being described as a child sleep-monitoring function. It can silently create or reuse external accounts, attach identity headers to requests, and send data off-device, creating hidden account linkage and unauthorized data flows that are especially sensitive in a children's monitoring context.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads identity material from workspace files and, if absent, generates and persists a default user identity in local storage for later reuse. For a child bedroom monitoring skill, silently deriving persistent identities is context-inappropriate and increases tracking, account correlation, and privacy risk without clear necessity or consent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
A broad default trigger on any uploaded child sleep audio/video can cause the skill to activate and process sensitive bedroom recordings without sufficiently precise user intent. Over-triggering is risky here because the inputs involve always-sensitive audio/video of children in private spaces.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The keyword triggers include broad, everyday sleep-related phrases, which can invoke the skill in contexts where the user did not intend child-bedroom monitoring or historical report access. In this privacy-sensitive domain, ambiguous triggering increases the chance of collecting or querying sensitive data unnecessarily.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly requires overnight video and audio capture in a child's bedroom, including cry detection and sleep-talk recognition, but provides no privacy, consent, retention, minimization, or access-control safeguards. Because this involves continuous surveillance of minors in a highly sensitive setting, the omission materially increases the risk of unlawful collection, overcollection, misuse, and exposure of intimate personal data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script initializes and uses an internal user identity via OpenIdUtil.resolve_current_open_id without clearly informing the user that account context may be resolved and applied. In a child bedroom monitoring skill that processes highly sensitive audio/video, hidden identity binding can cause analysis history, reports, or alerts to be associated with the wrong account or performed under an unexpected identity, creating privacy and authorization risks.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code reads the full local file contents and uploads them for analysis, but this file shows no user-facing consent, disclosure, or minimization controls before transmitting highly sensitive bedroom video/audio. Because the skill is designed for continuous child night monitoring, silent upload of infant/child recordings materially increases privacy and compliance risk if users are not clearly informed and given control.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The request flow can silently register/login a user and obtain tokens through network calls when tokens are missing, while non-debug mode suppresses visible disclosure. Hidden external account actions and background authentication are risky because users may not realize the skill is contacting third-party services or creating identities tied to monitoring data.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The code reads a workspace file containing identity-related data without any user-facing warning or permission boundary. Although file reading alone is limited, using hidden local identifiers in a children's sleep-monitoring context undermines transparency and can contribute to silent account correlation.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
This outbound POST sends account-related data, including openId/mobile/source fields, to an external endpoint. In a skill intended for bedroom sleep monitoring of children, undisclosed external transmission is more dangerous because it can expose household identifiers and link sensitive monitoring activity to remote accounts.

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 mp4/avi/mov 视频（**必须包含音频通道**），最大 10MB；建议覆盖整夜、夜视模式 |
| 🔎 使用提醒 | API 密钥可选，如果通过参数传入则必须确保调用鉴权成功，否则忽略鉴书；建议先核实采集端权限 |
| 🧑‍⚖️ 结果性质 | 分析结果仅作为养育辅助参考，本工具不替代专业儿科/睡眠医学诊断；长期睡眠质量差请咨询专业医生 |
| 🔏 隐私合规 | 隐私合规：儿童夜间音视频涉及未成年人隐私，使用前需取得监护人知情同意，并妥善保管/加密相关录像 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence
72% confidence
Finding
The hidden-instruction indicator suggests the manifest may contain invisible or non-obvious control text that can influence agent behavior without transparent review. Hidden directives are dangerous because they can conceal data-handling or execution constraints in a skill that already processes sensitive child audio/video and uses networked scripts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2