Back to skill

Security audit

Smart Baby Cry Analysis Skill | 婴儿哭声智能解析技能

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended to analyze infant cry media through a cloud service, but it also silently creates or reuses identities, stores tokens locally, and retrieves cloud history in ways users may not fully understand before installing.

Only install this if you are comfortable sending infant audio/video or provided media URLs to the Life Emergence cloud service and having the skill create or reuse a local service identity. Review and delete the workspace data database and smyx-api-key.txt identity material if you do not want reports and tokens to persist across sessions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no explicit permissions while its documented operation clearly requires shell execution, network access, local file handling, and likely environment access. This creates a misleading trust boundary for users and reviewers, who may approve or invoke the skill without understanding that uploaded media and local state will be transmitted and stored.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially exceeds the stated purpose: beyond infant-cry analysis it performs history listing, report-link handling, automatic identity/account management, local persistence, and broad media ingestion. This mismatch can mislead users into granting sensitive audio/video and accepting hidden backend interactions unrelated to the narrow claimed function.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The manifest and overview frame the skill as baby-cry audio analysis, but the content expands it to image/video analysis and cloud history retrieval. That scope expansion increases the chance of accidental activation on unrelated content and weakens informed consent around what data is processed externally.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
Claiming cry-sound analysis while accepting images, arbitrary local files, and network URLs broadens the attack and privacy surface beyond an audio-only skill. Users may provide sensitive media or remote resources without realizing the skill handles more than cry audio analysis.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
Automatic local file saving and mandatory cloud history queries are material behaviors not reflected in the top-level description. Hidden persistence and forced remote retrieval can surprise users and create avoidable privacy and data-retention risks, especially with infant audio/video.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Automatically creating or reusing a local default identity for a baby-cry analysis workflow introduces unnecessary account linkage and persistent tracking unrelated to the core purpose. In a parenting/infant context, silent identity binding makes the privacy implications more serious because highly sensitive family and child-related media may become associated across sessions without explicit consent.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The implementation is materially inconsistent with the declared infant-cry audio purpose: it analyzes video inputs and can retrieve analysis history instead of processing baby-cry audio. This kind of capability mismatch is dangerous because users and platform reviewers may grant the skill access or trust under false pretenses, while the code handles broader and more privacy-sensitive media than advertised.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The history-listing path exposes a capability unrelated to the stated infant-cry use case, enabling retrieval of prior analysis data via an open_id. Even if intended for compatibility, undeclared access to historical records increases privacy risk and broadens the data surface beyond what users would reasonably expect from a baby-cry detection skill.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The CLI help text and behavior clearly present this as a video analysis tool, contradicting the declared infant-cry audio functionality. This mismatch is a security and trust issue because it can conceal the real collection and processing of user media, undermining informed consent and potentially bypassing review expectations for the advertised skill category.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file exposes a broad generic API wrapper with add/edit/delete/http_* methods and a user lookup helper that are not constrained to the stated infant-cry-analysis purpose. In a skill context, this unnecessarily expands the capability surface, enabling arbitrary backend interaction if higher-level code or prompts can influence URLs, parameters, or call paths, which increases the risk of unauthorized data access or unintended side effects.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The get_user_by_username capability is unrelated to detecting and classifying infant cries, so its presence indicates unnecessary access to identity-related functionality. Even if intended for convenience, such account lookup can facilitate user enumeration or access to personal data when exposed through a skill that should only process audio-analysis workflows.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill is described as infant cry audio analysis, but this file defines persistent user-account storage and mutation logic, including lookup and update behavior for user identities. That is a strong scope mismatch: unnecessary identity management increases the amount of personal data the skill can collect, persist, and alter, expanding privacy and abuse risk without clear functional need.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This module creates and alters a shared local SQLite database even though the advertised capability is only audio-based infant cry analysis. Hidden persistence broadens the attack surface, enables silent retention of user-related data, and increases the chance of cross-skill data mixing within the shared workspace.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores authentication-like tokens and personal profile data such as username, realname, email, birthday, age, and sex, none of which are justified by the stated infant-cry-analysis purpose. Collecting and mutating such sensitive data creates significant privacy risk, and stored tokens especially raise the stakes because compromise could affect external accounts or services.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This utility introduces identity bootstrapping behavior unrelated to infant-cry analysis: it reads workspace identity material, selects or creates default users, and persists that identity for later use. In the context of a baby-audio skill, hidden account provisioning and identity persistence materially expand the privilege and privacy surface beyond the declared purpose.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The HTTP helper performs remote login/registration, injects auth headers, retries authorization, and persists returned tokens locally. That is well beyond a utility needed for baby-cry inference and creates a hidden authentication and remote-account lifecycle path that could transmit or retain user identity data without clear need or consent.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Reading a workspace API-key file and auto-creating default users/accounts gives the skill access to local identity material and lets it silently establish service identities. In this skill context, that capability is not justified by the manifest and increases the chance of undisclosed account linkage, impersonation, or data transfer under a synthetic user identity.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Overly broad trigger phrases for history-report retrieval may cause the skill to activate on generic requests and pull cloud-linked report data when the user did not intend to access this skill. Because reports appear tied to an internally managed identity, accidental activation can expose prior sensitive records.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The default activation rule is broad and can trigger whenever a user shares baby audio/video for analysis, without clear exclusions. In practice this increases the risk that private infant media is sent to the backend automatically when the user may only be asking for general advice or transcription.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill omits a clear privacy warning that uploaded local files and remote URLs are transmitted to external/cloud APIs. This is especially sensitive given the subject matter involves infant audio/video and potentially historical reports tied to persistent identity, making uninformed disclosure a significant privacy risk.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The code reads the entire local file into memory and sends it to an external analysis service without any visible consent prompt, disclosure, or data-minimization safeguards in this file. Because the skill is marketed as infant-care analysis, users may submit sensitive family recordings, increasing privacy risk if they do not understand that local content is being uploaded off-device.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill forwards user-supplied remote URLs to backend analysis without visible disclosure that the URL will be transmitted to an external service. In this context, URLs may point to private family media locations or signed links, so silent forwarding can expose sensitive resources or metadata beyond what users expect.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script accepts a hidden --api-key parameter suppressed from help output, which reduces transparency around credential handling and can mislead users or integrators about secret usage. Hidden credential inputs are risky because they encourage opaque execution paths, make auditability harder, and can lead to inadvertent exposure through shell history, process listings, or undocumented automation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2