Back to skill

Security audit

Family Conflict Aftercare Suggestion | 夫妻/家人冲突后情绪缓和提示

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it processes very sensitive household audio/video through cloud APIs while silently creating or reusing local identities and stored tokens.

Review carefully before installing. This skill should only be used where every affected household member has informed consent, cloud upload and report retention are acceptable, the correct jurisdiction-specific emergency resources are configured, and there is a clear way to delete local database records, stored tokens, uploaded media, and cloud reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises significant capabilities including shell execution, network access, local file read/write, and environment access without declaring permissions. In a privacy-sensitive family-monitoring context, this creates hidden attack surface and breaks least-privilege expectations, making it easier to exfiltrate recordings, persist local data, or invoke unintended commands through the bundled scripts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially differs from the actual operational model: instead of a narrowly scoped local aftercare detector, it uses remote APIs, manages identities/tokens, stores user data locally, and supports history retrieval. That mismatch is dangerous because users may consent to one kind of processing while the skill performs broader collection, persistence, and cloud transmission of sensitive in-home audio/video and relationship-conflict metadata.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill is presented as post-conflict soothing, but the documentation also enables cloud history-report retrieval and link output. Expanding into historical record access increases privacy and surveillance risk because highly sensitive domestic-conflict data may be enumerated or shared beyond what users expect from the manifest.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The documentation broadens the skill from soothing prompts into safety-escalation and hotline/reporting workflows that are not reflected in the top-level description. In a high-sensitivity domestic setting, undisclosed escalation behavior can surprise users, undermine consent, and cause inappropriate disclosures or interventions.

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The documentation claims the skill only performs event detection and aftercare suggestions, yet elsewhere instructs emergency safety intervention outputs. This contradiction can cause operators and users to misunderstand the system's decision scope, especially when handling potentially dangerous family-conflict situations with sensitive personal data.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill accepts arbitrary http/https URLs and forwards them to the backend analysis API, even though the manifest describes analysis of fixed in-home camera or local video inputs. This expands the data ingress surface beyond the declared capability and can enable analysis of third-party or externally hosted content without clear restriction, consent, or provenance checks.

Description-Behavior Mismatch

Low
Confidence
81% confidence
Finding
The skill exposes generic report listing and export-link generation functionality that is not described in the family-conflict aftercare manifest. In a sensitive domestic monitoring context, undisclosed access paths to prior analysis records or report images increase privacy risk and may broaden who can enumerate or retrieve sensitive outputs.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The implementation materially diverges from the stated purpose of a fixed in-home family-conflict aftercare skill: it exposes a generic video-analysis and history-listing CLI instead of narrowly scoped conflict detection and post-conflict soothing behavior. This kind of scope mismatch is dangerous because users, reviewers, or platform controls may grant trust and permissions based on the declared safety-sensitive use case while the code can process broader media inputs and perform unrelated analysis operations.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Allowing arbitrary remote video URLs expands the capability far beyond fixed household camera monitoring and enables analysis of externally hosted media from untrusted origins. In this skill context, that increases privacy, policy, and abuse risk because the tool can be repurposed for broad surveillance-style video processing or triggered to fetch attacker-controlled resources, contrary to the narrowly described family aftercare function.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes generic HTTP CRUD wrappers (`http_post`, `http_put`, `http_get`, `http_delete`) that can send requests to arbitrary caller-supplied URLs, which is broader than the declared family-conflict aftercare functionality. In a privacy-sensitive skill that monitors home audio/video events, this unnecessary network capability increases the risk of data exfiltration, unauthorized service interaction, or future misuse by other components even if this file alone does not show active abuse.

Context-Inappropriate Capability

Low
Confidence
79% confidence
Finding
The `get_user_by_username` helper provides identity lookup capability that is not obviously needed for detecting conflicts and sending aftercare prompts. In a household monitoring context, unnecessary user-resolution features can enable profiling or expansion into unrelated personal-data access, making the skill more privacy-invasive than its stated function suggests.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The User model stores broad personal data including real name, email, birthday, age, and tokens, which is not clearly necessary for a skill whose stated function is post-conflict soothing prompts after detecting arguments and gestures in the home. Because this skill context involves continuous in-home audio/video monitoring, unnecessary identity data materially increases privacy harm, reidentification risk, and breach impact.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code stores token and open_token values alongside user profile information without evidence of necessity, scoping, encryption, or lifecycle controls. In the context of a home-conflict surveillance skill, compromise of these fields could enable account takeover or cross-system access in addition to exposing highly sensitive household behavior data.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This utility inspects workspace state, reads local identity material from data/smyx-api-key.txt, and can create persistent default user records in a local database. Those behaviors are unrelated to the declared family-conflict sensing/aftercare purpose and create hidden identity persistence, increasing privacy risk in a household-monitoring context where users would reasonably expect only local detection and calming actions.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The HTTP helper performs external phoneLogin-based account creation/login, persists returned tokens, and reuses them automatically on later requests. That is materially beyond the manifest's described monitoring/soothing behavior and can silently transmit household-linked identity data to external services, creating account takeover, tracking, and privacy exposure risk.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill involves continuous in-home audio/video monitoring and cloud-backed history handling, yet the description does not prominently disclose those privacy implications up front. Because the monitored content includes family arguments and possible violence indicators, lack of clear notice materially increases the risk of uninformed consent and privacy harm.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation says uploaded attachments are automatically saved locally but does not clearly warn users about that persistence. For sensitive household audio/video, silent local retention increases the chance of unauthorized access, forensic recovery, or accidental reuse of intimate recordings.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
The skill hardcodes Chinese emergency resources without documenting locale restrictions or offering region-aware alternatives. In emergency or domestic-violence contexts, incorrect routing can delay access to appropriate help and create a false sense of support.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
The notes mandate Chinese emergency contacts on redline triggers without handling users outside that region. While not a classic exploit vector, in a safety-critical feature this design flaw can misdirect vulnerable users during urgent incidents and reduce trust in the system's safeguards.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This is a real privacy and safety issue. The document specifies continuous in-home microphone and camera monitoring of family conflict in common household spaces, including sensitive emotional and potential domestic-violence scenarios, but it does not place an explicit, prominent warning and consent requirement up front that clearly explains always-on surveillance, what data is collected, how long it is retained, who can access it, and the risks of misuse. In this context, omission is especially dangerous because affected individuals may be spouses, relatives, guests, or minors whose behavior is being inferred from audio/video signals inside the home.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This script processes in-home camera and microphone recordings of family conflict and silently resolves an internal user identity, yet provides no explicit privacy notice, consent flow, or disclosure at the point of use. In the context of intimate household surveillance, that omission is dangerous because users may not understand that sensitive audio/video and identity-linked event history are being analyzed and retrievable, increasing the risk of covert monitoring, misuse, and privacy harm.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code reads arbitrary local files and submits their full contents for analysis without any user-facing disclosure in this component. In a family-conflict monitoring skill handling highly sensitive home audio/video, silent upload of local media creates meaningful privacy and consent risks even if file type and size are validated.

Missing User Warnings

Low
Confidence
77% confidence
Finding
Remote URL input is passed to the analysis API without disclosure that external network resources may be fetched or processed. This is a transparency and consent issue, and in some deployments could also mask risky backend behavior such as fetching attacker-controlled resources.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2