Smart Baby Safety Care Skill | 婴儿智能安全看护技能

• Outcome: Review
• Latest audit: Aug 26, 2026 · 7:50 PM UTC
• Version: 1.0.13

Overview

This skill can analyze infant videos, but it also uploads sensitive media, creates or reuses an internal account, and stores account tokens locally in ways users should review carefully.

Install only if you are comfortable sending infant or home videos to the publisher's cloud service and allowing the skill to maintain a local identity/token database for report history. Treat its reports as advisory, not real-time child safety monitoring, and review the publisher's retention, deletion, and account/token handling practices before using real family footage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior requires shell execution, file read/write, network access, and likely environment use. This creates a transparency and governance gap: operators and users cannot accurately assess what the skill can access, which increases the chance of unintended data exposure or unsafe execution in production.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as infant visual safety monitoring, but the documented behavior extends into identity creation/reuse, token persistence, cloud history retrieval, and remote report orchestration. That mismatch is dangerous because users may provide highly sensitive infant media without understanding that the skill also manages accounts, stores identifiers locally, and interacts with remote services beyond simple analysis.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill exposes a listing/history mode via --list and show_analyze_list(open_id), which goes beyond the manifest’s stated real-time infant safety monitoring purpose. Features that enumerate prior analyses can reveal sensitive historical monitoring data and broaden the accessible data surface without clear need or user-facing justification.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code initializes internal identity context with OpenIdUtil.resolve_current_open_id(...) and later uses ConstantEnum.CURRENT__OPEN_ID for list retrieval, despite the skill being described as media analysis. Tying operation to internal user identity without clear user consent or necessity creates privacy risk and can enable cross-user data access if the identity resolution or downstream API authorization is weak.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The implementation is a generic media-analysis/reporting wrapper and does not contain infant safety monitoring-specific controls, detections, or scoping. In a safety-critical skill, this mismatch can mislead users into believing the system performs real-time infant hazard detection when it may instead submit content to a generic backend and return arbitrary analysis output, creating dangerous reliance and possible privacy over-collection.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill exposes report history listing and export-link generation unrelated to real-time infant monitoring. That broadens access to previously analyzed content and report artifacts, which may include sensitive infant imagery or household data, increasing privacy and unauthorized disclosure risk beyond the declared feature set.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation is a generic video analysis and listing CLI, while the manifest claims a narrowly scoped infant-safety monitoring skill. This mismatch is dangerous because it suggests the skill may process arbitrary video content and invoke broader backend capabilities than users expect, undermining informed consent and increasing the chance of covert or overbroad surveillance/data handling.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The history-listing capability keyed by user identifier is not necessary for immediate infant safety monitoring and expands access to previously analyzed content metadata/results. If exposed to an unauthorized or incorrectly resolved open_id, it could reveal sensitive historical monitoring records and enable privacy violations beyond the stated safety function.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file exposes a broad, generic API wrapper with arbitrary GET/POST/PUT/DELETE, CRUD helpers, pagination, and username lookup that are not constrained to the declared infant safety monitoring purpose. In a skill context, this expands the capability surface well beyond what is needed, enabling the skill or downstream code to access, modify, or enumerate unrelated backend resources if connected credentials or trusted network paths are available.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Username-based user lookup introduces an account-discovery capability unrelated to infant visual safety monitoring. If exposed through the skill flow or callable by adjacent components, it can facilitate user enumeration, privacy violations, or targeting of specific accounts, especially when combined with the broader generic API functions in this module.

Context-Inappropriate Capability

High

• Confidence: 80% confidence
• Finding: This model stores identity and authentication-related fields such as email, token, and open_token in a local SQLite database without any visible encryption, minimization, retention control, or access restrictions. In the context of an infant monitoring skill, collecting and persisting such data appears unjustified and increases privacy and credential-exposure risk if the workspace or database file is accessed by other components or users.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains unrelated capabilities for account bootstrap, token acquisition/caching, remote API use, and even a payment upsell flow. For an infant safety monitoring skill, these hidden cross-cutting behaviors materially expand the trust boundary and create unauthorized data handling and account-coupling risk if the utility is invoked.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code silently resolves or creates fallback open-id identities, including generating persistent local identities and reusing API-key-file values. That gives the skill an unjustified ability to impersonate or establish user identity without an explicit user action, which is especially risky given the skill's unrelated infant-monitoring purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The workspace-detection logic enumerates environment variables and filesystem structure to locate agent roots, data, and skills directories. While not directly exploitable by itself, it grants the skill unnecessary knowledge of the host agent layout and enables broader file access patterns than are justified for infant safety monitoring.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The auto-trigger keywords for historical report queries are broad enough to activate on ordinary conversation about reports or safety records. In this context, accidental triggering could cause retrieval and display of prior infant safety reports tied to the current internal identity, exposing sensitive historical data without clear user intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill handles infant images/videos and report data through remote APIs, but the user-facing description does not clearly warn that this sensitive content is transmitted to the cloud. Because the content concerns infants and home environments, the privacy sensitivity is especially high, making omission of this disclosure more dangerous than in a low-sensitivity domain.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow states that uploaded attachments are automatically saved as local files, but this local persistence is not clearly disclosed as a user warning. Silent local storage of infant media increases risk of residual sensitive files, unauthorized access on shared systems, and unexpected data retention.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends local video paths or remote URLs to an external analysis backend through skill.get_output_analysis(...) without any explicit warning that infant videos may leave the local environment. Because the content involves infants and home environments, undisclosed transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code accepts either local video files or remote video URLs and submits them for analysis without any visible user-facing consent, warning, or notice in this file. For an infant monitoring skill, uploaded media is especially sensitive, so silent transmission can lead to privacy violations, accidental third-party sharing, or unexpected processing of intimate household footage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI accepts local files or remote URLs and sends them for analysis without a clear user-facing disclosure that video content may be transmitted to an external service. For infant-monitoring footage, this is especially sensitive because it may contain minors, home interiors, and caregiving patterns, creating substantial privacy and compliance risk if users are unaware of the transfer.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Enabling urllib3/http.client debug logging can expose full request and response metadata, and possibly sensitive payloads, in logs. Because this module later handles tokens, identities, and API traffic, debug mode substantially increases the chance of credential or personal-data leakage.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically attaches application ID, access token, API key, authorization token, tenant code, skill platform metadata, and username to outbound requests. In the context of an infant-monitoring skill, this undisclosed transmission of identity and credential material is disproportionate and could expose sensitive account data to remote services or logs.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: The code performs an external POST to a health-platform login/registration endpoint using openId, mobile, and source values to create or retrieve an account. External transmission is not inherently vulnerable, but here it is security-relevant because it silently sends identity data to bootstrap accounts for a skill whose stated purpose does not require this behavior.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供安全参考，不能替代专业看护和家长实时监护 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 84% confidence
• Finding: The hidden/invisible instruction marker suggests obfuscated content in the skill file, which is a common technique for influencing agent behavior without obvious reviewer visibility. In a skill that already invokes shell commands, file handling, and cloud APIs, concealed instructions materially raise the risk of prompt injection or reviewer evasion.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "infant_safety_monitoring_analysis"
description: "Monitors infant behavior via visual AI, automatically identifying high-risk actions like rolling over, mouth/nose obstruction, climbing, or falling from bed, and triggers instant safety warnings. | 婴儿智能安全看护技能，基于视觉AI实时监测婴儿行为，自动识别翻身、口鼻遮挡、攀爬、翻越围栏、坠床等高风险动作，即时触发安全预警，守护婴幼儿睡眠与活动安全"
version: "1.0.17"
license: "MIT-0"
---

• Confidence: 88% confidence
• Finding: The metadata poisoning indicator, combined with the hidden-character signal and instruction-heavy manifest, suggests the skill metadata may be crafted to manipulate tool or agent interpretation beyond its stated purpose. Poisoned metadata is especially risky here because it can steer autonomous handling of infant media, cloud queries, and shell execution while appearing benign at the description layer.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2