Infant Blanket Kick Detection | 婴幼儿踢被/蹬被识别

• Outcome: Review
• Latest audit: Oct 26, 2026 · 10:44 PM UTC
• Version: 1.0.13

Overview

Shared accounts can expose private infant-monitoring reports, and the advertised export-only mode can still submit footage for analysis.

Wait for sender-isolation and export-only fixes before submitting private footage. Confirm the provider's processing, retention and account-deletion terms, and use a dedicated service credential. Continuous monitoring and automatic alerts remain unverified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/smyx_infant_blanket_kick_detection_analysis.py

Finding

CLI initialization discards the upstream sender identity and reuses a workspace-wide account

Content

View full analysis

Trigger condition

Different remote senders use the same Agent workspace, the upstream integration supplies OPENCLAW_SENDER_OPEN_ID but no OPENCLAW_SENDER_USERNAME, no API secret overrides identity, and the documented CLI is invoked without the hidden --open-id argument.

Impact

A second sender can retrieve report history produced by the first sender under the shared account, exposing infant-monitoring analysis and associated report links. New analyses are also attributed to that shared account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (26)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code's purpose is user-database management rather than infant blanket monitoring. Database persistence could support a larger monitoring system, but this chunk specifically implements account and token management without any demonstrated connection to the declared functionality. The assessment is limited to the supplied chunk; it does not establish what other parts of the skill implement or indicate that stored information is transmitted externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk does not implement the declared monitoring workflow and instead provides generic, partly disabled skill scaffolding. It does not actually execute the commented-out agent command. Imported base classes and services could provide additional functionality, but their behavior cannot be established from this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The reported attachment of credentials and identity information to caller-supplied API endpoints creates a credential-disclosure path if an attacker can influence --api-url. Silent account initialization and reusable default identities also require careful isolation because this service associates highly sensitive infant footage and report history with those identities; the referenced implementation was not provided for independent verification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk implements a general API-access layer rather than the declared monitoring behavior. HTTP helpers could support alerts or smart-home integrations, so their presence alone would not establish a mismatch. However, storage download-link retrieval and username-based user lookup introduce capabilities not explained by the description or connected to it in this code. This assessment is limited to the supplied chunk; it does not establish what other components implement or whether these methods are invoked.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk primarily implements API-backed video submission and report management. It contains no visible camera-stream handling, infant or blanket detection, coverage evaluation, kick recognition, or alerts. Analysis is delegated to imported service methods whose implementation is not supplied, so specialized detection cannot be ruled out downstream; nevertheless, the visible behavior does not substantiate the declared monitoring purpose and includes undeclared report-history functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code exposes generic video analysis and user-associated history retrieval. It contains no visible camera-stream processing, infant or blanket detection, coverage-threshold evaluation, kicking recognition, alerts, or smart-home integration. The delegated skill implementation is not supplied, so infant-specific analysis cannot be ruled out downstream; however, the visible workflow and additional history-retrieval capability are not accurately represented by the declared description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

Generic AI-analysis endpoints could support the declared feature, and the absence of detection logic in a configuration-only fragment is not independently sufficient to establish a mismatch. However, the explicit health-order report-export endpoint introduces an unrelated resource not explained by the description. This chunk only defines configuration; it does not demonstrate that any endpoint is actually called.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-infant-blanket-kick-detection-analysis"
description: "Using a night-time camera (infrared or low-light) above the crib, the system analyzes in real time the coverage of the blanket on the infant's body. It checks whether the blanket coverage is below a preset threshold (e.g., 50%) or recognizes the kicking motions that cause the blanket to slip off, then outputs an alert. | 通过婴儿床夜间摄像头（红外或微光），实时分析婴儿身体及被子的覆盖情况。可联动智能家居设备（如自动调高室温、推送提醒至父母手机），预防婴儿着凉。"
version: "1.0.19"
license: "MIT-0"
---

# 🛌 I

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The manifest provides no explicit tool or permission boundaries despite directing automatic local-file handling, script execution, and cloud requests. This is a least-privilege gap rather than proof of exploitation; its significance is greater because the workflow handles sensitive infant footage and persistent user identities.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises not to perform analysis, but args.export_env_only is never checked; when an input or URL is supplied, execution proceeds to skill.get_output_analysis regardless. This bypasses the user's explicit processing restriction and is especially concerning for sensitive infant bedroom footage; any transmission or retention depends on the unseen implementation and cannot be confirmed from this file.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are passed to the analysis API without disclosure that the file will be uploaded.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The code reads the selected local file and passes its complete contents to the analysis API without an upload disclosure or consent check in the shown implementation. Infant crib footage is particularly sensitive, so undisclosed external processing could expose private recordings beyond the user's expected trust boundary; the actual destination, retention, and any consent obtained elsewhere cannot be determined from this file.

Content

No source excerpt is available for this finding.

The documented export-only mode still performs video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises not to execute analysis, but its parsed value is never checked; when --input or --url is provided, execution still reaches skill.get_output_analysis(). This violates the user's explicit no-analysis choice and could trigger remote processing or disclosure of sensitive infant video, depending on the downstream implementation. The nursery-camera context increases the privacy consequences, although this file alone does not establish whether video is uploaded.

Content

No source excerpt is available for this finding.

save() is documented as creating a new record but can silently overwrite an existing record.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

save() catches every insertion exception and falls back to updating by supplied ID or username/realname, potentially turning a duplicate-record creation attempt into an overwrite of an existing user's columns, including authentication tokens. If untrusted input reaches this method without separate ownership checks, it can corrupt another user's data; the shared database increases the possible scope, although no direct compromise of infant monitoring or home controls is demonstrated.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation but never performs one or produces an analysis result.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The agent invocation is commented out, and accessing stderr on the replacement dictionary raises an AttributeError that is caught and suppressed, causing ai_chat to return None without analysis. If infant monitoring or alerting depends on this method, the silent failure could prevent alerts while leaving the surrounding system apparently operational, making this more consequential than an ordinary incomplete helper. The supplied file does not establish that monitoring actually calls this method or demonstrate an attacker-controlled exploit path.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The generically named open method always uses mode 'w', which immediately erases an existing file's contents. No docstring, comment, confirmation, or user-facing log explains this behavior; exception tracing only occurs after a failure.

Content

No source excerpt is available for this finding.

HTTP requests can silently register a remote account, beyond the declared blanket-monitoring and alerting behavior.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

When authentication tokens are missing, an ordinary HTTP operation can automatically invoke phoneLogin with silent=1 and register=1, without an explicit consent check in this code. This creates a remote identity and persistence side effect beyond the declared monitoring behavior; the sensitive household context makes undisclosed account linkage more concerning, although this snippet does not show infant imagery being transmitted.

Content

No source excerpt is available for this finding.

HTTP authentication silently transmits the current identity and requests remote account registration.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The authentication helper places the selected identity into both openId and mobile and submits a silent registration request without a visible disclosure or approval gate. The selected value can come from API_SECRET_KEY, so a configured credential may also be copied into identity fields rather than confined to its intended authentication use; this overlaps the registration finding rather than representing a separate proven compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The POST transmits identity and source information to the configured health-service endpoint as part of automatic login or registration. Network access alone is not a vulnerability, but the undisclosed identity transmission and possible reuse of API_SECRET_KEY make this instance a privacy and credential-handling concern; neither an attacker-controlled destination nor transmission of camera data is established.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and files, including during module import.

Low

• Category: Output Handling
• Confidence: 90% confidence

Finding

YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is absent, without a warning, log, or explanatory comment/docstring. BaseEnum.init_subclass invokes this loader at L053 and L058, so merely importing the module can modify the filesystem—an unexpected side effect of configuration loading.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()