ClawHub
Back to skill

Security audit

Baby Sleep State Monitoring Skill | 婴儿睡眠状态监测技能

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform infant sleep video analysis, but it silently creates or reuses a shared cloud identity and stores tokens for sensitive child-monitoring reports without clear user control.

Review before installing. This skill sends infant monitoring media and report queries to a remote cloud service and may silently create or reuse a workspace-wide account, storing reusable tokens locally. It is most appropriate only in a single-user, trusted workspace where users understand the cloud data flow and can accept shared local credential persistence.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/infant_sleep_monitoring_analysis.py:49
Finding

Workspace-Wide Fallback Identity Causes Cross-User Access to Infant Monitoring Reports

Content
View full analysis

Vulnerability Details

File Location: scripts/infant_sleep_monitoring_analysis.py:49-50; skills/smyx_common/scripts/util.py:462-466, 585-593; skills/smyx_common/scripts/dao.py:475-495; skills/smyx_analysis/scripts/api_service.py:29-37
Vulnerability Type: Broken user isolation through shared fallback credentials
Risk Level: High

Complete Code Snippets

scripts/infant_sleep_monitoring_analysis.py:49-50

python
# Initialize the internal user identity without requiring user input.
OpenIdUtil.resolve_current_open_id(
    args.open_id,
    use_current=bool(args.open_id)
)

skills/smyx_common/scripts/util.py:462-466

python
if not resolved_open_id:
    resolved_open_id = cls.get_api_key_file_open_id()
if not resolved_open_id:
    resolved_open_id = cls.get_or_create_default_open_id()

skills/smyx_common/scripts/dao.py:475-495

python
def get_first_default_user(
    self,
    prefix: str = "User_",
    username_length: int = 11
) -> Optional[User]:
    session = self.get_session()
    try:
        return session.query(self.__model__).filter(
            self.__model__.username.like(f"{prefix}%"),
            func.length(self.__model__.username) == username_length,
            or_(
                self.__model__.del_flag == 0,
                self.__model__.del_flag.is_(None)
            )
        ).order_by(
            self.__model__.create_time.asc(),
            self.__model__.id.asc()
        ).first()
    finally:
        session.close()

skills/smyx_common/scripts/util.py:585-593

python
found_user = user_dao.get_by_username(current__user_name)
if found_user:
    ApiEnum.TOKEN = found_user.token
    ApiEnum.OPEN_TOKEN = found_user.open_token
    current__user_name = found_user.username
if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
    new_current_user = _get_or_create_user(current__user_name)
    if new_cu
...[truncated 3145 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a trusted, authenticated per-caller identity from the hosting platform for every upload and historical-report operation.
  2. Reject analysis and --list requests when no trusted identity is available instead of creating or reusing a workspace-wide fallback user.
  3. Do not treat a caller-provided CLI value as authoritative identity. Derive the principal from authenticated platform context and verify its tenant membership.
  4. Partition local credential records by authenticated principal, tenant, and Agent context. Never select the earliest generic User_* record as a global fallback.
  5. Scope server-side report queries to the authenticated user and tenant, and enforce authorization on every report-detail or export-link endpoint.
  6. Store tokens in a protected credential store with restrictive access controls rather than in a broadly shared workspace database.
  7. Invalidate and rotate existing shared fallback tokens. Migrate existing reports to verified owners where possible.
  8. Add multi-user isolation tests proving that one caller cannot list, retrieve, or export another caller's reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (60)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of external HTTP requests, auth token handling, local file access, identity creation/reuse, and local user-database interaction is far broader than expected for a simple infant sleep analysis feature. Given the sensitivity of child-monitoring videos and associated parent identities, this mismatch materially increases privacy, data-governance, and unauthorized-access risks.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "infant-sleep-monitoring-analysis"
description: "Identifies sleep states like deep sleep, light sleep, waking, and restlessness. Generates daily sleep reports and schedule analysis to help parents understand their baby's sleep patterns. | 婴儿睡眠状态监测技能，识别熟睡、浅睡、苏醒、躁动不同睡眠状态，生成每日睡眠报告和作息分析，帮助家长掌握宝宝睡眠规律"
version: "1.0.21"
license: "MIT-0"
---

# 😴 Baby Sleep State Monitoring Skill | 婴儿睡眠状态监测技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

---

##

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation exposes a generic video-analysis and history-listing workflow that does not match the declared infant sleep monitoring purpose. This kind of capability mismatch is dangerous because it can mislead users and reviewers about what data is processed and what backend actions occur, increasing the risk of unauthorized video analysis, privacy violations, or hidden functionality outside the approved scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file exposes a generic API wrapper that can issue arbitrary GET/POST/PUT/DELETE requests and generic CRUD-style operations unrelated to infant sleep analysis. In the context of a narrowly scoped baby sleep monitoring skill, this creates unnecessary remote interaction capability that could be abused by other skill components to access or modify external systems beyond the declared purpose, increasing the attack surface substantially.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The add/edit/delete and generic mutation wrappers enable remote state changes without any visible scope restriction, authorization checks, or domain-specific validation. For a sleep monitoring skill that should primarily analyze and report infant sleep data, unjustified modification capabilities are dangerous because they can be repurposed to alter external records, trigger unauthorized actions, or serve as a covert control channel.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file defines a generic sys_user account model and DAO, including identity, email, birthday, and token-related fields, which is materially outside the stated infant sleep analysis purpose. In this skill context, collecting and managing account records increases privacy and security risk because it introduces user-identity storage without clear necessity or consent boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The model stores token and open_token values for users, but authentication-token persistence is not justified by a baby sleep monitoring/reporting skill. If this local SQLite database is accessed by another component or leaked from the workspace, those tokens could enable account takeover or unauthorized access to external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code reads an identity value from a workspace file, falls back to local database records, and creates persistent default identities when none exist. For an infant sleep analysis skill, this is unrelated credential and identity handling that can silently bind the skill to cross-session or cross-skill identities without clear user awareness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This utility performs remote account provisioning, token acquisition, token reuse, and authenticated API access that is far beyond the declared infant sleep monitoring purpose. In the context of a baby sleep skill, hidden identity bootstrapping and broad external API capability materially increase the risk of unauthorized data transmission, account misuse, and supply-chain style overreach.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares broad operational behavior—local file handling, shell execution, network/API access, and environment/config use—but does not declare any explicit tool scope or allowed-tools restrictions in the manifest. That increases the risk of over-privileged execution, makes security review harder, and can permit unintended capability use if the runtime honors implicit rather than explicit permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Much of the operational content, trigger definitions, workflow, and examples are presented only in Chinese even though the file includes some bilingual headings. This can amount to a language policy issue because the skill does not clearly offer users a language choice or state that Chinese is a required locale for a justified regional use case.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The history-report trigger phrases are broad enough that ordinary user language could unintentionally invoke cloud record retrieval. In this skill’s context, that is risky because it may cause privacy-sensitive infant monitoring reports to be fetched or exposed when the user did not clearly intend a historical data access action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that uploaded attachments or media are automatically saved as local files, but it does not clearly warn users about local persistence of potentially sensitive baby-monitoring footage. Silent local storage increases privacy risk, data retention concerns, and the chance that other local processes or users can access the media.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill requires direct cloud API access for historical report retrieval without clearly informing users that sensitive report data will be retrieved from a remote service. In the context of infant monitoring, undisclosed remote data handling is particularly concerning because it involves intimate household and child-related records.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2