Smart Baby Safety Care Skill | 婴儿智能安全看护技能

• Outcome: Review
• Latest audit: Oct 14, 2026 · 4:58 AM UTC
• Version: 1.0.17

Overview

This baby-monitoring skill is not clearly malicious, but it sends sensitive child media to cloud services and silently manages persistent identity and tokens with limited user control.

Review carefully before installing. Use only if you are comfortable uploading infant/home media or media URLs to the vendor cloud, allowing silent account creation/login, storing report-linked identity and tokens in the workspace, and retrieving cloud history through automatic triggers. Ask the publisher for explicit privacy, retention, authorization, deletion, and consent controls before production or family use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (57)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected behavior includes external HTTP communication, identity/open-id resolution, local directory creation, API key reading, and local user persistence, none of which are clearly reflected in the infant-monitoring description. In context, this is particularly dangerous because infant videos and associated identity metadata are highly sensitive, so undisclosed backend identity linkage and data movement materially increase privacy and security risk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "infant_safety_monitoring_analysis"
description: "Monitors infant behavior via visual AI, automatically identifying high-risk actions like rolling over, mouth/nose obstruction, climbing, or falling from bed, and triggers instant safety warnings. | 婴儿智能安全看护技能，基于视觉AI实时监测婴儿行为，自动识别翻身、口鼻遮挡、攀爬、翻越围栏、坠床等高风险动作，即时触发安全预警，守护婴幼儿睡眠与活动安全"
version: "1.0.23"
license: "MIT-0"
---

# 👶 Smart Baby Safety Care Skill | 婴儿智能安全看护技能
> **智能分析中枢** · 图片/视频智能分析

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill accepts user-provided media files and URLs and instructs use of a cloud/API service, but it does not clearly warn users that infant photos/videos and linked resources may be sent off-device for processing. In this context the omission is especially serious because the data involves children, making privacy expectations and consent requirements much higher.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file exposes a generic API client with broad HTTP and CRUD helpers (add, edit, delete, http_post, http_put, http_get, http_delete) that are not constrained to the infant safety monitoring purpose. In a skill that should primarily analyze infant safety events, such unrestricted remote-call capability expands the attack surface and can be repurposed to access or modify arbitrary backend resources if other parts of the skill can influence URLs or payloads.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code provides direct remote resource modification primitives through add, edit, delete, and raw HTTP verbs, enabling write/delete actions well beyond what is justified by passive infant monitoring and alerting. In this context, excessive modification capability is dangerous because compromised or misused skill logic could alter backend records, configurations, or user data unrelated to infant safety events.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code provisions and persists user identity material, reads local API-key-derived identity, and creates default accounts unrelated to infant visual safety monitoring. In the context of a baby safety skill, hidden account bootstrap and identity persistence materially expand scope and can enable undisclosed backend linkage, account creation, and tracking of users or environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section reads local identity data from files and writes or reuses user records in a local database, which is unnecessary for infant behavior detection and warning generation. In the context of a child-safety skill, undisclosed identity persistence is especially sensitive because it can enable user tracking, silent account binding, and retention of personal identifiers without clear need.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The request helper performs remote login/registration, token acquisition, token caching, and automatic retry/persistence behavior far beyond what is necessary for local infant monitoring. Because the manifest describes safety monitoring rather than account management or generic platform access, this hidden network/auth subsystem increases the risk of undisclosed data transmission, unauthorized account actions, and backend dependence.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and instructs use of capabilities including shell execution, network access, local file handling, and environment/config access, but does not declare any explicit tool scope or permissions boundary. That creates an overbroad execution surface where a host agent may grant more access than users or reviewers expect, increasing the risk of unintended command execution, file access, and external data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The history-report trigger phrases are broad enough that normal conversation about reports could automatically invoke cloud history retrieval. This can cause unintended access to stored analysis data or accidental disclosure of prior reports, especially in a domain involving sensitive child-monitoring media and associated metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow says identity is handled internally and may silently reuse a local default user or create one automatically without user opt-in. That can cause report mix-ups, cross-session data association, and privacy violations if multiple users share the environment or if historical reports are linked to an implicit account the user never approved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's docstrings, errors, CLI descriptions, and output messages are consistently written in Chinese with no option to select another language or locale. This is a natural-language policy concern because the skill imposes a language choice on all users rather than offering opt-in or configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

analyze_video forwards a local file path or remote URL into skill.get_output_analysis(...), which likely submits infant video content to an external service, but the script provides no explicit notice, consent flow, or privacy warning. Because the data involves infants and potentially in-home recordings, undisclosed transmission can expose highly sensitive personal and household information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script exposes a user-specific history/listing function via show_analyze_list(open_id) that is not necessary for one-shot infant video safety analysis. Features that enumerate prior analyses tied to a user identifier increase privacy risk and can enable unauthorized access to sensitive monitoring history if identity handling or authorization is weak in downstream components.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The tool resolves and uses an internal OpenID for a video analysis workflow even when identity is not needed for core functionality. In the context of infant monitoring, silently binding analyses to a persistent user identity increases privacy sensitivity and creates a larger attack surface for profiling, tracking, and exposure of child-related safety data.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2