ClawHub
Back to skill

Security audit

Family / Couple Conflict Intensity Detection | 夫妻/家庭争吵强度识别

Security checks across malware telemetry and agentic risk

Overview

This skill handles very sensitive household audio/video but uses cloud services, dev network configuration, and local identity/token storage in ways users should review carefully before installing.

Install only if you are comfortable with family audio/video or video URLs being processed by the configured backend service, with a local account/token database being created or reused, and with historical reports being retrievable through that account context. The publisher should switch from dev/private HTTP config to production scoped endpoints, disable debug logging, clearly disclose upload/storage/retention behavior, and require explicit consent before media analysis or history retrieval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
77% confidence
Finding
Here getattr(self.__model__, key) uses keys from the caller-supplied filters dict, so an attacker who can influence filters may access unintended model attributes or cause exceptions. In a generic DAO used for user records, this can enable unsafe query construction patterns, probing of internal schema, and bypass of intended field-level restrictions in higher layers.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
77% confidence
Finding
This count() path repeats the same issue as list(): filter keys are taken from external input and resolved dynamically on the model. That can lead to unauthorized querying on sensitive fields, schema probing, or denial-of-service via repeated invalid attribute requests if upstream code passes user-controlled filters.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises significant capabilities—shell execution, file access, environment access, networking, and local writes—without declaring permissions or surfacing them to users. In a skill that handles highly sensitive family audio/video and cloud-linked history, this creates a transparency and consent gap that can conceal data access, persistence, or exfiltration paths.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose says this is a real-time living-room conflict detector with mobile alerts, but the behavior includes backend account creation/authentication, local identity persistence, cloud history retrieval, and generic media processing that are not prominently disclosed. This mismatch is dangerous because users may submit intimate household recordings without understanding that accounts, tokens, local databases, and remote report access are involved.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The document says identity must never be requested or exposed, yet it also states the system will auto-create and reuse a default local user when no upstream identity is present. In a sensitive domestic-monitoring context, silent identity creation and reuse can cause cross-session data mixing, unintended account linkage, and report retrieval under the wrong local persona.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script performs hidden identity resolution and exposes a history/listing capability that is not clearly aligned with the stated purpose of real-time conflict-intensity detection. In a highly sensitive domestic-surveillance context, undisclosed linkage of analyses to an internal user identity and retrieval of prior results increases privacy risk, enables unnecessary profiling, and may expose sensitive household incident history.

Intent-Code Divergence

Medium
Confidence
79% confidence
Finding
The CLI advertises API URL, API key, URL input, and output-detail behaviors that are not actually enforced by this wrapper, which creates a deceptive interface and can cause operators to make unsafe assumptions about where data is sent, how authentication is applied, and what processing occurs. In a surveillance/behavior-analysis tool, misleading data-flow and output semantics can undermine informed consent, auditing, and safe deployment.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them for analysis, which expands behavior beyond the stated fixed in-home camera use case. This creates scope creep and can enable analysis of third-party, externally hosted, or unintended surveillance footage, increasing privacy and policy risk.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The output includes a report export URL capability that is not described in the manifest, indicating the skill can expose retrievable report artifacts beyond simple real-time alerting. Undocumented export or retrieval features increase the chance of unintended data exposure, especially for sensitive household conflict analysis results.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The historical report listing function goes beyond the declared real-time detection purpose and enables browsing prior analysis outputs. For a family-conflict monitoring skill, retaining and surfacing a history of sensitive behavioral inferences raises additional privacy and misuse concerns.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The implementation does not match the skill’s stated purpose of real-time family-conflict audio/video detection with alerting. Instead, it exposes a generic video-analysis/listing wrapper around shared backend methods, which can mislead users or integrators into believing sensitive safety monitoring is occurring when it is not. In a domestic safety context, this mismatch is risky because users may rely on absent conflict detection or alerting capabilities.

Intent-Code Divergence

Low
Confidence
79% confidence
Finding
The CLI is documented as a generic 'video analysis tool,' which conflicts with the specialized family-conflict detection claims in the skill metadata. This inconsistency can cause operator misunderstanding, incorrect deployment, and overtrust in capabilities related to monitoring potentially dangerous domestic situations. While not a direct code-execution flaw, it is a security-relevant integrity issue because it undermines safe use of a high-sensitivity surveillance feature.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The file implements generic user-account storage and mutation, including usernames, real names, email, tokens, and update helpers, which is unrelated to the declared conflict-intensity detection purpose. In this skill context, collecting and mutating identity and token data broadens the data-access surface and raises privacy and unauthorized-account-handling concerns, especially for a home surveillance-oriented skill.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility layer performs broad account bootstrap, login, token management, and persistence against external services that are not justified by the declared purpose of family-conflict intensity detection. In a skill handling highly sensitive in-home audio/video context, hidden identity creation and outbound account operations materially expand data-flow, privacy, and abuse risk beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Embedding payment/recharge workflow handling in a household conflict-monitoring skill is functionally unrelated and can be used to steer users into account/payment actions they did not anticipate. Even if not directly exploitable as code execution, it is a trust and scope violation that increases social-engineering and deceptive-behavior risk.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads an internal identity value from a workspace file and silently falls back to creating or reusing local identities when none is supplied. For a skill advertised as conflict-intensity sensing, this undisclosed identity resolution and persistence is an unnecessary collection/attribution mechanism that increases privacy and account-linkage risk.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The skill is configured to trigger by default for broadly described living-room audio/video analysis requests, without strong exclusions or confirmation gates. Because the content involves sensitive surveillance-like processing of household media, over-broad invocation increases the chance of accidental analysis and data transfer of private recordings.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-report function is set to auto-trigger from a long list of natural-language phrases, making sensitive cloud report retrieval easier to invoke unintentionally. In this context, unintended retrieval could expose private conflict history, report links, or metadata associated with a household account.

Missing User Warnings

High
Confidence
95% confidence
Finding
This skill processes extremely sensitive domestic audio/video and also performs cloud history queries, yet the up-front description does not prominently warn about privacy risks, remote transmission, storage, or retrieval behavior before use. That omission undermines informed consent in one of the highest-sensitivity consumer contexts: inside-home interpersonal conflict monitoring.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The call to resolve_current_open_id initializes or retrieves user identity implicitly, without a clear user-facing disclosure in the CLI flow. Because this skill processes intimate family-conflict surveillance data, silent identity association materially increases privacy sensitivity and the risk of covert tracking or cross-session linkage.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The code reads local file contents and uploads them for analysis without any visible user-facing warning, consent prompt, or disclosure in this component. Because the skill processes highly sensitive audio/video of domestic conflict, silent upload materially increases privacy risk even if the backend is expected to analyze the media.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Enabling HTTPConnection and urllib3 debug logging can expose request URLs, headers, bodies, and responses in logs. In this skill context, those values may include tokens, usernames, and potentially sensitive household-monitoring metadata, making debug mode especially dangerous if logs are accessible or centrally collected.

Missing User Warnings

Low
Confidence
84% confidence
Finding
Reading an internal identity value from a workspace file without clear disclosure is a privacy and transparency issue, especially when used to drive remote account operations. While the file read itself is local, it can silently bind user activity to an identifier the user did not knowingly provide for this skill.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
This code sends externally facing login/registration data, including openId/mobile/source fields, to a remote endpoint. In a family-conflict detection skill operating on sensitive domestic context, undisclosed outbound transmission of identity-related data is more concerning because users would reasonably expect local sensing and narrowly scoped notifications, not hidden account bootstrap traffic.

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | 看电视/电影、儿童打闹游戏、激烈讨论但无攻击性词汇等情形容易被误识为冲突，建议结合声学 + 视觉 + 攻击性词汇多模态综合判定 |
| 🔎 使用提醒 | 攻击性词汇命中**仅本地推理**，**禁止上传原始语音**到任何外部服务 |
| 🔏 隐私合规 | 红线约束：**禁止**根据本工具结论给当事人贴"家暴施害者/受害者"标签；**禁止**自动报警；**禁止**长期存储原始音视频；**禁止**输出法律意见或处方 |
| 🧑‍⚖️ 结果性质 | 紧急联系人联动需用户**事先取得双方知情同意**，默认关闭；高强度连续多次时附**反家暴热线 12338** 与就近社区调解资源参考 |
| 🔏 隐私合规 | 隐私合规：家庭音视频涉及高度敏感家庭隐私，使用前需取得**家庭所有成年成员**明确知情同意，妥善加密保管；建议优先采用人体轮廓 + 面部马赛克模式 + 仅保存指标统计 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence
72% confidence
Finding
The hidden-instruction marker combined with imperative operational directives is suspicious in a skill manifest because it can be used to manipulate downstream agent behavior or conceal execution constraints from normal review. In this case, the surrounding content includes strict behavioral commands about script usage and network handling, which raises the risk of prompt/tooling manipulation in an already sensitive data-processing workflow.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2