ClawHub
Back to skill

Security audit

Smart Baby Cry Analysis Skill | 婴儿哭声智能解析技能

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review before installation because it silently links user identity, stores cloud tokens, and sends sensitive baby media through broad network code that does not match the narrow audio-only description.

Install only after the publisher narrows the skill to the disclosed media types, removes silent account creation or gets explicit consent, uses HTTPS production endpoints, and protects or avoids persistent token storage.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
skills/smyx_common/scripts/config-dev.yaml:1
Finding

Private Media and Authentication Credentials Transmitted over Plaintext HTTP by Default

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/config.yaml:15, skills/smyx_common/scripts/config-dev.yaml:1-4, skills/smyx_common/scripts/util.py:610-612,646, skills/smyx_analysis/scripts/skill.py:113-132
Vulnerability Type: Plaintext transmission of sensitive data
Risk Level: High

Vulnerable Code

skills/smyx_common/scripts/config.yaml:15:

yaml
env: dev

skills/smyx_common/scripts/config-dev.yaml:1-4:

yaml
ApiEnum:
  base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"
  base-url-open-h5: "http://192.168.1.234:4100"
  base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz"

skills/smyx_common/scripts/util.py:610-612,646:

python
headers.setdefault("X-Access-Token", ApiEnum.TOKEN)
headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY)
headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN)

response = requests.request(method, url, *args, json=data, params=params, headers=headers,
                            timeout=int(timeout), **argss)

skills/smyx_analysis/scripts/skill.py:113-132:

python
if (input_path.startswith("http://") or input_path.startswith("https://")):
    params.update({
        "videoUrl": input_path
    })
else:
    _validate_file(input_path)

    # Automatically detect MIME type
    mime_type, _ = mimetypes.guess_type(input_path)
    if mime_type is None:
        mime_type = 'application/octet-stream'

    # Read file contents
    with open(input_path, 'rb') as f:
        file_content = f.read()

    files = {
        'file': (os.path.basename(input_path), file_content, mime_type)
    }

Technical Analysis

The bundled primary configuration explicitly selects the development profile. That profile replaces the HTTPS production endpoints with plaintext HTTP endpoints on 192.168.1.234.

The request utility attaches access tokens, API credentials, authorizat ...[truncated 1844 chars]

Remediation
View remediation

Remediation Suggestions

  1. Change the release configuration to use a production profile with HTTPS endpoints by default.
  2. Remove env: dev from distributed artifacts and require an explicit development-only override.
  3. Reject non-HTTPS service endpoints unless a narrowly scoped local test mode is explicitly enabled.
  4. Do not permit plaintext HTTP merely because an address belongs to a private network.
  5. Retain TLS certificate verification and do not expose configuration options that silently disable it.
  6. Add startup validation that fails closed if authentication-bearing traffic would use HTTP.
  7. Rotate access and authorization tokens that may already have been transmitted over plaintext connections.
  8. Document media upload and retention practices and obtain explicit user consent before transmitting child recordings.

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/util.py:572
Finding

Authentication Headers Can Be Disclosed to Arbitrary Absolute URLs

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py:572-612,646
Vulnerability Type: Unrestricted authenticated request destination
Risk Level: Medium

Vulnerable Code

python
if not url.startswith("https://") and not url.startswith("http://"):
    url = cls.BASE_URL + url
headers['App-Id'] = ConstantEnum.APP__ID

if not (ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID):
    OpenIdUtil.resolve_current_open_id(use_current=False)
current__user_name = ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID

headers.setdefault("X-Access-Token", ApiEnum.TOKEN)
headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY)
headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN)

response = requests.request(method, url, *args, json=data, params=params, headers=headers,
                            timeout=int(timeout), **argss)

Technical Analysis

The shared request utility distinguishes relative URLs from absolute URLs only by checking for an http:// or https:// prefix. An absolute URL is accepted without validating its hostname, port, or relationship to the configured API service.

Irrespective of the resulting destination, the utility automatically adds X-Access-Token, X-Api-Key, and Authorization headers. Therefore, any caller that can control the absolute URL passed to this utility can cause service credentials to be sent to an unrelated or attacker-controlled host.

The reviewed infant-analysis workflow currently uses configured relative API endpoints for its principal operations, so a direct user-controlled URL-to-this-sink path was not confirmed in the audited code. Nevertheless, this is an exploitable security flaw in the bundled shared utility and can affect current or future callers that pass an absolute URL.

Attack Path

  1. An attacker influences a caller of `RequestUtil.http_r ...[truncated 1245 chars]
Remediation
View remediation

Remediation Suggestions

  1. Maintain an explicit allowlist of authorized API schemes, hostnames, and ports.
  2. Reject absolute URLs that do not match the configured trusted API origins.
  3. Require HTTPS for every authentication-bearing request.
  4. Split the utility into separate authenticated internal-API and unauthenticated external-fetch clients.
  5. Add authentication headers only after destination validation succeeds.
  6. Disable redirects for authenticated requests or remove sensitive headers whenever a redirect crosses origins.
  7. Normalize and parse URLs with a standard URL parser rather than relying on string-prefix checks.
  8. Add tests proving that credentials are never transmitted to untrusted hosts, alternate ports, malformed URLs, or redirect targets.

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/dao.py:460
Finding

Reusable Cloud Access Tokens Stored Unencrypted in a Shared Workspace Database

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py:589-604, skills/smyx_common/scripts/dao.py:159-173,460-461
Vulnerability Type: Insecure storage of authentication credentials
Risk Level: Medium

Vulnerable Code

skills/smyx_common/scripts/util.py:589-604:

python
if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
    new_current_user = _get_or_create_user(current__user_name)
    if new_current_user:
        ApiEnum.TOKEN = new_current_user.get("token")
        ApiEnum.OPEN_TOKEN = new_current_user.get("openToken")

        current_user_info = new_current_user.get("userInfo")
        if current_user_info:
            current_user_info["token"] = new_current_user.get("token")
            current_user_info["openToken"] = new_current_user.get(
                "openToken")
            user_model = User.load(current_user_info)

            user = user_dao.save(
                user_model
            )

skills/smyx_common/scripts/dao.py:159-173:

python
if not db_path:
    db_path = "smyx-common-claw.db"

db_path = self.get_db_path(db_path)

self.engine = create_engine(f"sqlite:///{db_path}", echo=False)

self.SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=self.engine)
self._create_tables()
self._alter_tables()

skills/smyx_common/scripts/dao.py:460-461:

python
token = Column(String(500), comment="token")
open_token = Column(String(1000), comment="open token")

Technical Analysis

Tokens returned by the remote registration or login endpoint are copied into a user model and persisted directly in SQLite string columns. The database is deliberately redirected into the workspace-wide data directory.

The implementation does not encrypt token values, use an operating-system credential store, enforce owner-only file permissions, or isolate credentials from other Skills that can read the same workspace. ...[truncated 1326 chars]

Remediation
View remediation

Remediation Suggestions

  1. Avoid persisting access tokens if short-lived in-memory credentials are sufficient.
  2. Store unavoidable persistent credentials in an operating-system-backed secret manager.
  3. If a secret manager is unavailable, encrypt tokens with authenticated encryption and keep the encryption key outside the database.
  4. Create credential files with owner-only permissions and verify permissions before every read.
  5. Isolate credential storage by Skill and user rather than using a broadly shared workspace database.
  6. Use short-lived, narrowly scoped tokens with server-side expiration, revocation, and rotation.
  7. Never include token fields in generic ORM serialization, logging, exports, or backups.
  8. Migrate existing plaintext token records securely and revoke old values after migration.

T08 · Insecure Dependencies

Note
Location
skills/smyx_analysis/requirements.txt:3
Finding

Ambiguous Dependency Name Creates Dependency Confusion and Installation Integrity Risk

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_analysis/requirements.txt:3
Vulnerability Type: Incorrect or ambiguous third-party dependency declaration
Risk Level: Low

Vulnerable Code

text
pydash==8.0.6
SQLAlchemy==2.0.46
yaml==6.0.3

Technical Analysis

The source code imports the yaml module, but the expected and commonly used distribution providing that module is PyYAML. The shared component correctly declares PyYAML==6.0.3, while the analysis component declares yaml==6.0.3.

Python import names do not necessarily match package-index distribution names. Resolving the wrong distribution name can cause installation failure or, when an internal or alternate package index contains that name, install an unintended package. Installation and package build hooks can execute code before the Skill itself runs.

No malicious dependency payload was present in the audited project. The finding concerns supply-chain ambiguity and unsafe package resolution.

Attack Path

  1. An installer processes skills/smyx_analysis/requirements.txt.
  2. It requests the distribution named yaml rather than the intended PyYAML.
  3. A configured public, private, or fallback package index resolves that name to an unintended distribution, if available.
  4. The package's installation or build logic executes with the installer's privileges.
  5. The unintended package may access files, environment variables, network resources, or the resulting runtime environment.

If no such distribution is available, the likely result is denial of service through installation failure rather than code execution.

Impact Assessment

The primary confirmed impact is unreliable or failed installation. In a dependency-confusion scenario involving an untrusted package source, impact could include arbitrary code execution with the package installer's privileges and compromise of the Skill environment.

The exploitation sc ...[truncated 133 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace yaml==6.0.3 with PyYAML==6.0.3.
  2. Maintain one authoritative dependency file to prevent inconsistent declarations.
  3. Pin dependencies using package hashes, such as pip's --require-hashes.
  4. Install only from explicitly trusted package indexes.
  5. Disable unintended public-index fallback when using private package repositories.
  6. Generate and review a lock file containing exact package names, versions, sources, and hashes.
  7. Add automated dependency validation to confirm that declared distributions provide the imported modules.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (58)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates authenticated network requests, local file operations, workspace discovery, identity resolution, token storage, and backend login flows that are unrelated to the stated infant-cry analysis purpose. This combination is dangerous because it enables credentialed backend access and persistent local state under misleading childcare branding, raising both privacy and abuse risks.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "infant-cry-analysis"
description: "Detects baby cries via audio AI in real-time, analyzes causes, and precisely identifies needs like hunger, tiredness, pain, discomfort, or irritability to assist new parents. | 婴儿哭声智能解析技能，通过音频AI实时检测婴儿哭声，自动解析哭声成因，精准识别饥饿、困倦、疼痛、身体不适、情绪烦躁等不同需求，辅助新手爸妈科学育婴"
version: "1.0.15"
license: "MIT-0"
---

# 🍼 Smart Baby Cry Analysis Skill | 婴儿哭声智能解析技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatic creation or reuse of internal user identities is not justified by the core task of analyzing an uploaded cry recording. This is dangerous because it creates hidden account linkage and persistence, potentially tying sensitive family media and report history to backend identities without explicit user awareness or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation handles local video files and remote video URLs, while the skill is advertised as infant cry audio analysis. This is a security-relevant capability mismatch because users and calling agents may provide sensitive data under false assumptions, enabling unintended collection or processing of unrelated media. In a parenting/health-adjacent context, this increases the risk of privacy violations and deceptive data handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file materially contradicts the advertised skill purpose: it implements video analysis and history listing rather than infant-cry audio analysis. This kind of capability mismatch is dangerous because it can mislead users and reviewers about what data the skill actually processes, potentially causing unexpected collection or transmission of video content, which is more sensitive than the declared audio-only use case.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file implements a broad network API helper with generic GET/POST/PUT/DELETE, pagination, and CRUD-style add/edit/delete methods that are not justified by the stated infant-cry analysis purpose. In a narrowly scoped skill, this materially expands the capability surface, enabling arbitrary backend interaction or data access/modification if other parts of the skill can influence URLs or parameters.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The add, edit, delete, http_post, http_put, and http_delete methods expose generic resource-modification primitives unrelated to baby-cry detection. In the context of a consumer parenting skill, unnecessary write-capable API abstractions increase the risk of unauthorized state changes, misuse of connected services, or hidden secondary behavior beyond the declared functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This code performs automatic phone-login/registration against an external health backend using a locally derived username/openId, despite the skill being described as infant cry analysis. That mismatch is highly suspicious because it can create or bind external accounts and transmit identity data without the user understanding that unrelated backend enrollment is happening.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares capabilities that imply shell execution, network access, file reads/writes, and environment access, but does not declare an explicit tool scope or permission boundary. In an agent setting, this makes the skill harder to audit and increases the risk of over-privileged execution, especially because the workflow instructs automatic file saving and remote API access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation simultaneously markets infant cry audio analysis and image analysis capabilities, which is a contradictory scope signal. This ambiguity is security-relevant because it obscures what data types may be collected and processed remotely, making informed consent and permission review harder.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest presents an infant cry audio skill, but the documentation broadens the scope to image/video analysis, local file saving, and cloud report retrieval. Scope expansion inside documentation is dangerous because it quietly widens what users may submit and what the skill may do with that data beyond the original, expected purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

History report query functionality goes beyond one-off infant cry analysis and introduces account-linked retrieval of prior data. In a family/health-adjacent context, that increases privacy risk because historical records may reveal sensitive patterns, and users may not expect this broader retention and lookup capability from the skill's title alone.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad trigger phrases for automatic history-report queries can cause unintended invocation of remote data retrieval when a user is merely discussing reports. That raises privacy and surprise-execution risks, especially because the skill says the query must go directly to a cloud API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Automatically saving uploaded attachments to local files without a prominent user warning introduces undisclosed file-write behavior. In agent environments, silent persistence of media can create privacy, retention, and disk-abuse risks beyond the user's expectation of transient analysis.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2