Back to skill

Security audit

Infant Blanket Kick Detection | 婴幼儿踢被/蹬被识别

Security checks across malware telemetry and agentic risk

Overview

The skill is for cloud-based infant video analysis, but it also silently creates or reuses account identity, uploads sensitive media, queries cloud history, and stores auth tokens with insufficient user control.

Review this skill before installing. It may send infant videos or supplied video URLs to lifeemergence.com services, create or reuse an internal user identity, retrieve cloud report history, and persist account tokens locally. Install only if that cloud processing and local account persistence are acceptable, and avoid using it with recordings unless guardians have consented and retention/deletion expectations are clear.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet its documented behavior includes shell execution, local file read/write, environment access, and network operations. This mismatch prevents meaningful consent and review, and is especially risky because the skill handles infant video and may transmit or persist sensitive data without explicit disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest claims a narrowly scoped real-time infant blanket-monitoring function, but the described implementation performs identity creation/reuse, remote account login, backend history retrieval, and generic remote media submission. That gap is dangerous because operators may trust it as a local safety-monitoring skill while it actually sends sensitive infant footage and account-linked metadata to remote services and stores identifiers locally.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code performs hidden internal identity resolution via `OpenIdUtil.resolve_current_open_id` and supports listing analyses by `open_id`, even though the skill is presented as a local real-time infant blanket detection tool. In a baby-monitoring context this introduces an unjustified privacy boundary crossing: a user may unknowingly query or associate stored monitoring results with an internal identity, enabling unauthorized access to sensitive household monitoring metadata if the surrounding utilities are weakly protected.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs even though its stated purpose is analysis from a crib-mounted night camera. This broadens the trust boundary and can enable unintended remote content ingestion, including attacker-controlled URLs, privacy-invasive sources, or use outside the declared safety context. In a baby-monitoring skill, that mismatch is more concerning because users may assume tightly scoped device input rather than arbitrary external media.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Accepting arbitrary network video URLs expands the trust boundary and can enable server-side fetching of attacker-controlled resources. If downstream code or backend services retrieve the URL, this can lead to SSRF-style access to internal services, unintended data processing, or abuse outside the stated crib-camera use case; the infant-monitoring context makes this more concerning because users may assume only trusted local camera footage is handled.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file exposes a generic API client with pagination, CRUD-style helpers, and arbitrary URL-based HTTP methods that materially exceed the stated purpose of infant blanket coverage analysis. In a skill handling nursery camera workflows and smart-home actions, such broad network capability increases the chance of unauthorized data transfer, command execution against unrelated backend endpoints, or future abuse by other components without purpose limitation.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The user lookup helper introduces account-identification capability that is not justified by the manifest's infant monitoring function. In a baby-monitoring context, unnecessary access to user identity data expands privacy exposure and could enable enumeration or correlation of parental accounts if misused elsewhere in the skill.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The file defines a generic user-account DAO handling usernames, real names, email, birthday, token, and open_token data, which is not aligned with the stated infant blanket coverage detection purpose. This expands collection and persistence of personal and authentication-related data beyond the skill's declared function, increasing privacy and abuse risk if the database is accessed or reused by other components.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This module implements broad shared-database CRUD and path-redirection logic for arbitrary local persistence, far beyond the manifest's described real-time camera analysis and alerting. In the skill context, that mismatch is suspicious because it creates a reusable data-management layer capable of storing unrelated records in a shared workspace data directory, increasing the attack surface and potential for privacy leakage across skills or agents.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This utility file contains user/account provisioning logic and default identity creation that are unrelated to the advertised infant blanket monitoring function. That mismatch is dangerous because it silently expands the skill's authority and creates persistent identities or account state without clear user consent, increasing privacy and platform abuse risk.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The HTTP helper automatically injects tokens, resolves default identities, and can trigger remote phone-login/registration flows during ordinary requests. In the context of a baby-monitoring skill, this is overprivileged and dangerous because it can send identity and authentication material off-device without a clear need tied to blanket coverage analysis.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code reads a workspace identity file and local database, then reuses or creates a default open-id if none is supplied. This is dangerous because it silently binds skill activity to local identity material unrelated to infant monitoring, enabling unintended cross-context tracking and unauthorized use of existing accounts.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger is broad enough that any crib-night video upload may invoke the skill automatically, even when the user's intent is different. In a privacy-sensitive context involving infant recordings, over-triggering can cause unintended processing, storage, or transmission of highly sensitive media.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The historical-report auto-trigger keywords are overly broad and can match general requests, causing automatic backend queries for prior infant-monitoring records. This creates a privacy and data-minimization risk because sensitive account-linked history may be retrieved without sufficiently specific user authorization.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill reads arbitrary local file contents and uploads them for analysis without any user-facing disclosure or confirmation in this file. That creates a privacy and data-handling risk because sensitive local media may be transmitted to backend services unexpectedly, especially in the context of infant monitoring where recordings are highly sensitive.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code reads identity/credential-like material from data/smyx-api-key.txt with no user-facing warning or consent flow. In a camera-based infant monitoring skill, undisclosed access to workspace identity files is especially concerning because users would not expect local credential harvesting behavior from the stated functionality.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This request path transmits user identity fields and authentication tokens in outbound HTTP requests without any visible consent, notice, or feature-specific justification. Because the skill's declared role is local blanket/kick detection for an infant, silent network transmission materially increases privacy, account, and surveillance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
90% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 输入要求:支持 mp4/avi/mov 视频,最大 10MB;建议俯视全身、夜视模式 |
| 🧑‍⚖️ 结果性质 | 预警结果仅作为辅助监护参考,本工具不替代成人监护;触发预警时请及时上前查看 |
| 🔏 隐私合规 | 隐私合规:婴儿视频涉及未成年人隐私,使用前需取得监护人知情同意,并妥善保管/加密相关录像 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
Confidence
71% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-infant-blanket-kick-detection-analysis"
description: "Using a night-time camera (infrared or low-light) above the crib, the system analyzes in real time the coverage of the blanket on the infant's body. It checks whether the blanket coverage is below a preset threshold (e.g., 50%) or recognizes the kicking motions that cause the blanket to slip off, then outputs an alert. | 通过婴儿床夜间摄像头(红外或微光),实时分析婴儿身体及被子的覆盖情况。可联动智能家居设备(如自动调高室温、推送提醒至父母手机),预防婴儿着凉。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
76% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2