Elderly Loneliness / Depression-Tendency Behavior Analysis | 老年人孤独/抑郁倾向行为分析

• Outcome: Review
• Latest audit: Nov 5, 2026 · 7:24 AM UTC
• Version: 1.0.13

Overview

This skill can upload private home videos despite its no-analysis option and stores cloud access tokens in a shared local database.

Wait for the export-only and API-destination controls to be fixed before using private footage. Obtain consent covering third-party uploads and account creation, confirm the provider's retention and report-access policies, and require protected token storage and disabled HTTP wire logging. The review inspected all bundled files without executing the skill; cloud-side safeguards remain unknown.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk contains no camera access, video or audio processing, behavior detection, or analysis-result handling. Its implemented functionality centers on managing a local user database, including identity details and tokens, rather than the declared elderly-behavior monitoring task. Database storage can be a supporting implementation detail, but this chunk does not establish such a connection: its only concrete model is a general-purpose user record. This assessment applies to the supplied chunk and does not establish what other parts of the skill implement. No network transmission or exfiltration is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied chunk does not implement the declared monitoring purpose. The apparent external-agent invocation is disabled, so it should not be treated as actual command execution. Imported base classes and services could provide additional functionality, but their implementations are not supplied; no behavioral detection can be established from this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Ordinary formatting, polling, filesystem, and HTTP helpers could support the declared skill and are not independently grounds for a mismatch. However, this module also implements an undisclosed account-provisioning and credential-management workflow: it resolves or creates an identity, sends it to a remote endpoint with registration enabled, and persists returned user/token information. That is materially broader than the stated video-behavior detection purpose. The assessment is limited to this chunk; it does not establish that behavioral detection is absent elsewhere or that video data is transmitted.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The analysis workflow lacks an explicit warning that sensitive home footage is processed by a remote API and reports are accessible through a cloud service.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

Although the document mentions cloud reports and APIs, it does not clearly explain that analyzing a local file transfers its contents to a remote processor. Generic consent to monitoring is not necessarily informed consent to third-party processing of bedroom footage and mental-health-related observations.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to run analysis, but the code still invokes analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser accepts an option explicitly promising not to perform analysis, but execution never checks that option. With an input supplied, a caller relying on this non-analysis mode can unintentionally initiate processing and remote transfer of sensitive home footage.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are passed to the analysis API without disclosure that the file will be uploaded.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The method reads the complete local file into a multipart payload and passes it to the analysis API without a visible remote-transfer authorization check. For intimate home recordings and mental-health-related analysis, an inadequately disclosed upload creates a substantial privacy exposure even if uploading supports the intended functionality.

Content

No source excerpt is available for this finding.

The documented export-only mode does not prevent video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The export-only argument is accepted but never consulted, so supplying it with a video input still invokes analysis. This defeats the caller's explicit expectation of no analysis and can cause unintended remote processing of private footage.

Content

No source excerpt is available for this finding.

The skill includes shared user-account and credential storage capabilities unrelated to the declared video-analysis purpose.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

Account storage can legitimately support cloud reports, so it is not inherently unrelated to video analysis. However, this implementation maps authentication tokens directly to ordinary string columns in a shared workspace SQLite database without visible encryption or restrictive permission enforcement, exposing usable credentials to other principals able to read that database.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation, but the implementation never invokes the agent or returns analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L26 explicitly claims that ai_chat invokes openclaw agent through subprocess, but both the command contents and subprocess call are commented out at L48–66. Instead, L68 creates an empty dictionary; accessing result.stderr raises an exception that is caught at L81, causing the method to return None rather than the documented analysis result or session ID.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its write behavior.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The generically named open helper always uses mode 'w', which immediately truncates an existing file. No docstring, explanatory comment, confirmation, or action-specific log discloses this potentially destructive behavior; exception tracing does not warn about successful truncation.

Content

No source excerpt is available for this finding.

The request helper silently provisions a remote user account, beyond the manifest's video-analysis scope.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

An ordinary request can automatically invoke phoneLogin with register=1 and silent=1, transmitting the selected identity and persisting returned account credentials locally without an explicit enrollment step in this code. Hidden remote enrollment creates an unexpected privacy and account-management side effect, particularly concerning in a home-monitoring skill handling sensitive elder-care information; the snippet does not establish that video is included in this registration request.

Content

No source excerpt is available for this finding.

HTTP requests can silently trigger remote account registration and identity transmission.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The helper embeds silent account registration and sends the selected username as both openId and mobile, making a routine HTTP operation perform an additional identity-disclosing action. This is the same underlying enrollment issue identified by SDI-1, not a separate exploit, and the sensitive monitoring context increases the importance of explicit consent and identity minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This POST is the transmission point for the automatic enrollment issue: it sends identity and source information to the configured health-service endpoint without an explicit enrollment authorization gate in the shown code. External networking alone is not a vulnerability, but this undisclosed identity-bearing side effect warrants confirmation; neither a malicious destination nor transmission of camera footage is established.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Loading configuration silently creates directories and YAML files, including during module import.

Low

• Category: Output Handling
• Confidence: 90% confidence

Finding

YamlUtil.load writes a new configuration file and creates parent directories when the requested file is absent, without a prompt, log, docstring, or explanatory comment. Because BaseEnum.init_subclass invokes this loader at L053 and L058, defining the enum classes during import can modify the filesystem without disclosure.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default