Smart Baby Cry Analysis Skill | 婴儿哭声智能解析技能

• Outcome: Review
• Latest audit: Aug 28, 2026 · 9:53 PM UTC
• Version: 1.0.11

Overview

The skill performs the advertised infant-cry analysis, but it also silently creates or reuses identities, stores tokens locally, and retrieves cloud history in ways users should review before installing.

Install only if you are comfortable with infant/family media or URLs being sent to the Life Emergence service, a local workspace identity and database being created or reused, tokens being stored locally, and cloud report history being queried automatically from report-listing requests. Treat the output as parenting reference only, not medical advice.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 80% confidence
• Finding: This query builder applies filters using attribute names taken directly from the filters dictionary via getattr(self.__model__, key). While it is not classic SQL injection, untrusted callers can select arbitrary model fields for querying, which can bypass intended access restrictions, expose unexpected records, or trigger errors/denial of service through invalid attributes. In this skill, generic database access is already broader than needed for infant cry analysis, which increases the concern.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: The count() method repeats the same unsafe pattern of using caller-supplied filter keys with getattr(self.__model__, key). This can enable unauthorized probing of model structure and record counts on sensitive fields, which is especially problematic given the presence of user-account and token-related data unrelated to the stated skill purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises no explicit permissions while its documented behavior requires shell execution, local file read/write, environment access, and network communication. This creates a transparency and governance gap: users and platforms cannot accurately assess what the skill will access before it runs, which increases the chance of unauthorized data handling or unsafe execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior significantly exceeds the stated purpose of infant cry analysis by including cloud history retrieval, local identity creation/reuse, account/login/token handling, generic media processing, and report link generation. When a skill performs materially broader functions than advertised, users may unknowingly expose personal data and the agent may execute actions outside expected consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The documentation broadens the skill from audio cry analysis to image/video analysis and cloud report retrieval, which is beyond the user-expected scope. Scope expansion increases the chance that unrelated media or sensitive household data will be uploaded, processed, or stored without clear necessity.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: Declaring images and generic network URLs as inputs is inconsistent with a skill positioned as infant cry audio analysis. This mismatch can cause overcollection of data and may lead users to submit unnecessary or sensitive content that is then sent to remote services.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Automatic cloud history querying is not necessary for the core task of analyzing a provided cry sample and introduces access to potentially sensitive historical records. In a parenting/infant-health context, historical reports may contain personal, behavioral, or medical-adjacent data, making unintended retrieval more privacy-sensitive.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: Automatically saving uploaded attachments locally is broader than required unless persistence is strictly needed for analysis. Local retention of infant audio/video increases the risk of accidental disclosure, reuse across sessions, or insecure storage of sensitive family data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Automatically creating and reusing local default user identities goes beyond the declared cry-analysis function and silently establishes persistent identity state. This can enable cross-session tracking, unintended account linkage, and unauthorized access to prior reports, especially when users are not informed that identities are being created or reused.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script exposes a history-listing path tied to an internal identity (open_id) that is unrelated to core cry-analysis functionality and is triggered without user-visible authentication prompts. Because it resolves and uses a current internal identity and supports listing prior analysis results, it risks unauthorized access to another user's historical baby-audio analysis metadata or outputs, which is especially sensitive given the family/child context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes a broad, reusable API client with generic CRUD methods and arbitrary URL-based HTTP helpers that are not constrained to infant-cry analysis functionality. In the context of a narrowly scoped baby-audio skill, this creates unnecessary capability expansion: other components could use this wrapper to call unrelated backend endpoints, access or modify data, or repurpose the skill as a general network proxy.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The get_user_by_username function adds user-account lookup capability that is unrelated to detecting and analyzing infant cries. Even if intended for convenience, it enables identity enumeration or access to user metadata beyond the declared purpose of the skill, which is especially concerning because the surrounding file already provides broad generic API access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This file defines a persistent user-account data model and DAO, including identifiers and profile fields, despite the skill being described as infant cry audio analysis. Unrelated account persistence expands the attack surface and creates unnecessary collection and retention of personal data without clear justification from the skill's stated function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The model includes storage for token and open_token values, which are highly sensitive credentials, yet such capability is not justified by an infant cry analysis feature. Persisting tokens in a local/shared SQLite database materially increases the risk of credential theft, account takeover, and cross-component abuse if the workspace or database is accessed by another skill or agent.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation says it is a local lightweight database wrapper, but the implementation forcibly redirects database files into a shared workspace data directory across agents/skills. That mismatch can mislead reviewers and developers, resulting in sensitive data being stored in a broader trust boundary than expected and enabling cross-skill data exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote identity bootstrap, login/registration, token handling, and even billing-related flows that are unrelated to infant cry analysis. This significantly expands the skill's privileges and data flows, creating hidden account creation and external service interaction that a user would not reasonably expect from an audio-analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads a workspace identity file, reuses local user records, and creates persistent default identities without clear linkage to the advertised cry-analysis function. Hidden identity resolution and persistence can cause silent tracking, cross-session correlation, and unintended reuse of credentials across unrelated operations.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill performs agent workspace discovery and creates data/skills directories despite this behavior not being justified by the stated infant cry analysis purpose. Unnecessary filesystem awareness and directory creation increase the attack surface and can enable persistence or unintended interaction with other agent resources.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The history-report trigger phrases are broad enough to match ordinary user language, which can cause unintentional activation of cloud retrieval features. That is risky because it may expose private report metadata or cause network actions the user did not clearly intend to authorize.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The default activation condition is too ambiguous for a skill that can save files, call shell scripts, and query remote services. Overbroad activation increases the risk that the agent invokes the skill on loosely related media-analysis requests and performs actions beyond the user's expectation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that attachments are automatically saved locally but does not clearly warn users in a prominent, consent-oriented way. For infant audio/video, local persistence materially affects privacy risk because users may assume uploads are transient and analysis-only.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation indicates that provided network URLs are fetched by a remote API service but does not clearly warn users that their URLs and referenced media will be sent off-box for retrieval and analysis. This can leak sensitive links, tokens embedded in URLs, or private media locations to third-party infrastructure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill reads arbitrary local files and uploads their full contents to a remote analysis service without any visible user-facing disclosure, consent checkpoint, or data-minimization logic in this code path. In the context of a parenting/infant-analysis skill, users may reasonably expect limited audio processing, so silently uploading local media increases privacy and compliance risk, especially if sensitive family recordings are involved.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script accepts local file paths or remote URLs and forwards them for analysis without any explicit notice, consent flow, or clear disclosure that media may be transmitted or processed externally. In the context of a baby-monitoring style skill, the content is especially privacy-sensitive, so silent processing of infant/family media increases the risk of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When debug mode is enabled, the code turns on verbose HTTP and urllib3 logging, which can expose request URLs, bodies, and response contents. Since this same file handles tokens, identity values, and remote login flows, debug logging materially increases the risk of leaking sensitive data into console or log sinks.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2