Security audit
Security checks for vulnerabilities and agentic risk
This skill is cloud-backed home camera fatigue monitoring with silent identity setup and token persistence, so users should review its privacy and account behavior before installing.
Install only if you are comfortable sending home camera video or URLs and fatigue history to the configured cloud service. Before use, confirm opt-in, pause/disable, bystander notice, retention/deletion, account identity, and token-storage behavior.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
The skill appears to create or resolve user identities, store them locally, perform authenticated external requests, and provision accounts, none of which are central to the declared fatigue-analysis behavior. In a home-surveillance context this broad hidden identity and network machinery is especially dangerous because it enables tracking, linkage, and off-device transmission of sensitive behavioral data.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-commuter-fatigue-care-analysis"
description: "Through a fixed camera in a smart-home living room, the system analyzes office worker behavior in the first 30 minutes after coming home, detecting slumped sitting / reclining (relaxed posture, back-to-sofa angle > 120°), facial fatigue features (visible eye bags, downturned mouth corners, frequent blinking), and sighing frequency (rapid chest/abdomen rise-fall with audible exhale). | 通过智能家居客厅的固定摄像头，分析上班族回家后30分钟内的行为，检测瘫坐/斜躺（姿态放松、背部与沙发夹角>120°）、面部疲惫特征（眼袋明显�
The skill proposes continuous in-home camera/audio monitoring plus cloud history queries without a prominent upfront privacy warning and consent framing. Because the monitored data includes behavior inside a living room and potentially audio, inadequate notice and consent create major privacy, compliance, and trust risks.
The skill includes hidden identity initialization, local default-user fallback, and automatic user creation without clear necessity for the stated fatigue-care purpose. Silent identity binding is especially dangerous here because the data concerns intimate in-home behavior, making unauthorized linkage and retention more harmful.
This file exposes broad generic CRUD and raw HTTP helper methods (add, edit, delete, http_post, http_put, http_get, http_delete, and user lookup) that go well beyond the skill’s stated purpose of local fatigue detection and comfort prompting. In a smart-home skill handling sensitive in-home observation context, this creates an unnecessary capability surface that can be used by other components to send, fetch, modify, or delete arbitrary remote data, enabling covert exfiltration or unauthorized backend interactions if the wrapper is reused unsafely.
The skill manifest describes fatigue observation and comfort responses, but this file defines a persistent user-account DAO with identity-oriented records and default-user lookup logic. That mismatch indicates collection and management of user identity data beyond the stated purpose, increasing privacy risk and violating data-minimization expectations in a camera-enabled home setting.
The User model stores sensitive personal/profile data including real name, email, birthday, age, plus token and open_token fields, none of which are necessary for the advertised fatigue-care behavior. In a smart-home camera context, unnecessary retention of identifiers and authentication-like tokens materially increases privacy impact and breach severity.
This utility module performs remote account creation/login, token retrieval, and authenticated API calls that are unrelated to the manifest's stated local fatigue-care analysis behavior. In the context of a smart-home camera skill, hidden identity bootstrapping and backend communication materially increase privacy and security risk because user identifiers and tokens may be created and transmitted without clear necessity or informed consent.
The skill declares no explicit tool/permission scope even though the documentation indicates capabilities for shell execution, filesystem access, network access, and environment use. In an agent setting, missing least-privilege boundaries increases the chance that the skill can access local data, invoke scripts, or contact external services beyond what users expect.
Automatic activation when the user comes home is broad for a surveillance-oriented home skill and may trigger monitoring without sufficiently specific user intent. In a private-home context, overly broad triggers increase the chance of collecting sensitive data unexpectedly or when guests are present.
Documentation adds smart-light control and self-care checklist actions not present in the manifest. Undeclared actuation is risky because users may not realize the skill can control home devices or influence environment settings.
Broad keyword-based invocation for analysis and history lookup can trigger unintentionally, especially for privacy-sensitive functions like report retrieval. That raises the risk of exposing or processing sensitive wellness history without sufficiently deliberate user intent.
The manifest describes a limited fatigue-analysis/care skill, but the documentation expands it to cloud history retrieval and weekly trend summaries. That scope expansion matters because it introduces longitudinal profiling and additional remote data access beyond the initially declared purpose.
The document specifies continuous in-home camera monitoring, optional audio analysis, and automated smart-home interventions during a sensitive post-arrival window, but it does not present an explicit upfront consent and privacy warning at the point where the behavior is defined. In a home-surveillance context, lack of clear notice and informed opt-in can lead to covert monitoring, unexpected device actuation, and privacy harms for both the registered user and bystanders such as family members or guests.
Detected: suspicious.install_untrusted_source