Elderly Loneliness / Depression-Tendency Behavior Analysis | 老年人孤独/抑郁倾向行为分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 1.0.8

Overview

This skill is a sensitive elder home-video analysis client, but it silently creates or reuses identities, stores tokens locally, and sends private footage and report queries to cloud services with weak scoping.

Install only after confirming the monitored elder has informed consent, the publisher can explain where video/audio and reports are stored, and the package is changed or configured to use trusted HTTPS endpoints, explicit account authorization, no silent default identity creation, and safe credential storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/util.py:572
• Finding: Authentication Credentials Can Be Forwarded to Arbitrary HTTP(S) Destinations<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py`, lines 572–646 **Vulnerability Type**: Unrestricted credential forwarding and plaintext transport **Risk Level**: High ### Vulnerable Code ```python if not url.startswith("https://") and not url.startswith("http://"): url = cls.BASE_URL + url headers['App-Id'] = ConstantEnum.APP__ID # ConstantEnum.CURRENT__USER_NAME = ConstantEnum.CURRENT__OPEN_ID = "ou_86fdd8e0d5f116c18a9dd550abefe6d2" if not (ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID): OpenIdUtil.resolve_current_open_id(use_current=False) current__user_name = ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) except Exception as e: CommonUtil.trace_exception_stack(e) ...[truncated 3282 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only relative API paths in the shared authenticated request wrapper. 2. Resolve relative paths against a fixed, trusted HTTPS origin. 3. If absolute URLs are operationally required, parse them with `urllib.parse.urlparse` and enforce an exact scheme, hostname, and port allowlist. 4. Reject plaintext HTTP, embedded credentials, protocol-relative URLs, loopback addresses, private-network addresses, and cloud metadata endpoints. 5. Attach authentication headers only after confirming that the final destination is a trusted origin. 6. Disable automatic cross-origin redirects or validate every redirect target before following it. 7. Separate authenticated API requests from generic unauthenticated URL retrieval. 8. Add tests proving that credentials are not attached to unapproved hosts or plaintext destinations. 9. Rotate any credentials that may already have been sent to an untrusted destination. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/util.py:414
• Finding: API-Key File Contents Are Misused and Transmitted as User Identity Data<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py`, lines 414–424, 458–468, and 548–561 **Vulnerability Type**: Sensitive credential disclosure through identity confusion **Risk Level**: Medium ### Vulnerable Code ```python @classmethod def get_api_key_file_open_id(cls): """读取工作区 data/smyx-api-key.txt 中的内部身份值。""" api_key_path = os.path.join(cls.get_workspace_data_dir(), "smyx-api-key.txt") try: if not os.path.exists(api_key_path): return None with open(api_key_path, "r", encoding="utf-8") as f: value = f.read().strip() return value or None except Exception as e: CommonUtil.trace_exception_stack(e) return None ``` ```python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """解析并初始化当前 open-id，返回最终使用值。""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id ``` ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") except Exception as _e: CommonUtil.trace_exception_stack(_e) return {} ...[truncated 2307 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use separate files and configuration fields for API credentials and internal user identities. 2. Rename the identity file to an unambiguous name such as `smyx-open-id.txt`. 3. Never interpret the contents of an API-key file as an OpenID, username, or mobile identifier. 4. Validate identity values against a strict expected format before using or transmitting them. 5. Store API keys in an operating-system credential store or protected environment variable rather than a general workspace data file. 6. Restrict credential-file permissions to the owning user and avoid persisting tokens in plaintext database fields where possible. 7. Transmit only the minimum identity fields required by the authentication endpoint; do not duplicate an internal identifier into a `mobile` field unless it is genuinely a verified mobile identifier. 8. Document the external processing, identity association, retention period, deletion procedure, and consent requirements for sensitive reports. 9. Migrate existing installations carefully: classify existing file values before renaming or transmitting them, and rotate any credential that may already have been disclosed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Authenticated external API communication, user/account lookup, token persistence, workspace discovery, and filesystem access go beyond the declared elder behavior analysis purpose. Because the subject matter involves intimate household monitoring and mental-health-adjacent inference, undisclosed account and token handling materially increase privacy, abuse, and breach impact.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill handles highly sensitive home video of elderly people and generates mental-health-adjacent reports, yet the description lacks a clear upfront warning that data may be transmitted to and stored in the cloud. Without explicit disclosure, users may unknowingly expose intimate domestic surveillance data and inferred emotional-risk information to remote systems, creating severe privacy and consent failures.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The default trigger is overly broad and may cause automatic activation whenever any elderly-related video URL or file is supplied. For a skill dealing with sensitive in-home surveillance and mental-health-adjacent inference, broad automatic triggering can lead to unintentional processing of private footage without sufficiently specific user intent or consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code reads an identity from a workspace file, reuses database identities, or silently generates and persists a new default user identifier. For a skill whose stated function is local video-behavior analysis, silent identity recovery/creation is unjustified and dangerous because it creates a durable cross-session identity that can later be used for external requests without informed user consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility performs outbound authentication, account creation/login, token caching, and authenticated API calls that are unrelated to the declared purpose of analyzing elderly home video for behavioral indicators. In this context, hidden identity and token management materially expands the skill's authority and enables silent communication with external services using local or generated identities, which can expose user data and create unauthorized accounts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries while its described operation requires shell, filesystem, network, and identity-related capabilities. In a skill handling highly sensitive in-home elderly video and report data, this omission prevents users and reviewers from understanding what data can be accessed, transmitted, or persisted, increasing the risk of over-privileged execution and unintended exfiltration.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file presents the core description in both Chinese and English by default and continues to structure the skill as bilingual throughout. There is no indication that the user can choose a preferred language or locale, which may conflict with organizational language-choice policies.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The keyword trigger list is broad for a sensitive monitoring skill and lacks strict scope boundaries. This increases the chance of accidental invocation based on casual mentions of loneliness, depression, or elderly care, which could route sensitive media or records into analysis unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill expands from local video behavior analysis into cloud history-report querying and report-link retrieval, but that broader data interaction is not clearly front-and-center in the manifest. This is particularly dangerous because historical reports about an elderly person's emotional-risk status are highly sensitive and may be exposed or queried without fully informed user understanding.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Automatic identity handling and user association are introduced even though the skill is described primarily as video behavior detection. Hidden identity resolution is risky because it silently links sensitive home-video analysis and mental-state reports to a persistent user identity, increasing tracking and privacy harm if misused or breached.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The report export endpoint exposes a path for extracting full analysis reports, which likely contain intimate behavioral observations and inferred emotional-risk information about elderly people. Documenting export functionality without prominent warnings and controls increases the risk of unauthorized sharing, bulk exfiltration, or overbroad internal access to especially sensitive personal data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes continuous in-home video and optional audio monitoring of elderly individuals in private spaces such as bedrooms and living rooms, including analysis of highly sensitive behavioral and mental-health-adjacent signals. Even though it mentions technical options like face mosaicking, it lacks explicit privacy, consent, retention, access-control, and secondary-use warnings, which is dangerous because implementers may deploy invasive surveillance and behavioral inference without adequate safeguards.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The method returns a fixed Chinese-language heading string, which imposes a specific language on users without any visible opt-in, locale selection, or explanation. This matches the language/locale policy violation category because the file contains natural-language output that is hardcoded to one language.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill imports and uses OpenID-based identity handling despite the stated purpose being standalone video analysis. Pulling in hidden identity context expands the trust boundary and may link highly sensitive behavioral or mental-health inferences to user identities, creating privacy, access-control, and data-minimization concerns.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2