Baby Sleep State Monitoring Skill | 婴儿睡眠状态监测技能

• Outcome: Review
• Latest audit: Aug 29, 2026 · 8:23 PM UTC
• Version: 1.0.11

Overview

This skill performs the advertised baby sleep video analysis, but it also uses cloud services, automatic identity handling, and local token/profile persistence that need careful review.

Review this skill before installing. Use it only if you are comfortable sending baby-monitor videos or URLs and report history to lifeemergence.com services, and with the skill creating/reusing a local identity, local SQLite database, and tokens. Avoid giving it unrelated media or URLs, and verify the publisher's privacy and retention practices first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 74% confidence
• Finding: This method applies filters using getattr(self.__model__, key) where key comes from the caller-provided filters dictionary. Without validating allowed field names, an attacker or unintended caller can query on arbitrary model attributes, which can expose fields the API did not intend to make queryable and can trigger exceptions for invalid attributes, enabling denial-of-service against callers that do not handle them safely.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 72% confidence
• Finding: As with list(), count() accepts arbitrary filter keys and resolves them dynamically on the ORM model. This can let callers probe model structure, count records by sensitive fields, or cause unhandled exceptions with invalid keys, creating an unnecessary attack surface for information disclosure and service instability.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to use shell execution, local file handling, cloud/network access, and environment-linked behavior, yet no explicit permissions model is declared in the manifest. This creates a capability/visibility mismatch: reviewers and users cannot easily tell that uploaded baby-monitor footage may be written locally and sent to external services, increasing the risk of silent data exposure or over-privileged execution.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill accepts any local file path with a supported extension or any remote HTTP(S) URL and forwards that content to a backend analysis API, while the manifest describes a narrowly scoped infant sleep monitoring capability. This broader input surface can be used to exfiltrate unrelated local videos or analyze arbitrary remote media under the guise of a baby sleep skill, creating a scope-expansion and privacy risk.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The skill exposes report listing and export-link generation features that are not described in the manifest, extending the effective capability beyond simple sleep-state detection and reporting. Undocumented retrieval of prior reports can increase data exposure, especially if reports contain sensitive infant or household information.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially diverges from the declared skill purpose: instead of infant sleep-state monitoring logic, it exposes a generic video-analysis and history-listing workflow. This kind of scope mismatch is dangerous because it can conceal undeclared collection, processing, or transmission of arbitrary user video under a benign childcare description, undermining informed consent and policy review.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Accepting arbitrary remote video URLs enables the skill to fetch and process content from untrusted external sources without being justified by the stated baby sleep-monitoring purpose. That broadens the attack surface for privacy abuse, unintended data ingestion, and possible SSRF-like backend fetching behavior if the downstream analyzer retrieves attacker-controlled URLs.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: Describing the CLI as a generic 'video analysis tool' contradicts the declared infant sleep-monitoring function and signals undeclared capability scope. Misleading or inconsistent labeling increases the risk that users and reviewers will misunderstand what data is collected and how broadly the tool can be used.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file exposes a generic network service layer with broad CRUD and arbitrary HTTP methods (`http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the infant sleep monitoring function described in the manifest. In a read/analysis-oriented skill, this creates capability overreach: other parts of the skill can invoke arbitrary remote endpoints or modify/delete remote data without any visible scope restriction, increasing the risk of abuse, data exfiltration, or unintended side effects.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The `add`, `edit`, and `delete` methods provide direct remote state-changing operations, which are not justified by a skill whose stated purpose is sleep-state analysis and reporting. Because these methods simply forward caller-supplied URLs and arguments, they enable unauthorized or opaque modification/deletion behavior if reached by higher-level logic, making the mismatch with the skill context more dangerous.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The infant sleep monitoring skill includes a generic user-account persistence layer that is not clearly necessary for analyzing baby sleep states. Unrelated account storage expands the data-collection surface and increases the chance of retaining personal data beyond the skill's stated purpose, which is especially sensitive in a baby-focused context where parents may not expect identity persistence.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The model stores tokens, open tokens, real names, email, birthday, and other profile data without any visible justification tied to infant sleep monitoring. In this skill context, collecting and persisting authentication-style secrets and PII is disproportionate to the stated function, raising the risk of privacy harm, credential exposure, and unauthorized profiling if the local database is accessed or reused by other components.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The utility code for a baby sleep monitoring skill contains unrelated logic to provision users, obtain tokens, persist them locally, and authenticate to external health APIs. This creates hidden account creation and outbound identity transmission behavior that exceeds the skill's declared purpose, increasing the risk of unauthorized data sharing, account misuse, and deceptive functionality.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill inspects the broader agent workspace and creates data/skills directories automatically, which is unrelated to infant sleep analysis and expands the code's reach into the host environment. In an agent setting, workspace discovery and directory creation can facilitate persistence, cross-skill interference, or staging of additional content beyond the expected analytics function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads an internal identity from local files, queries local databases for user records, and generates persistent fallback identities when none exist. For a sleep-monitoring skill, this is unrelated and dangerous because it silently establishes or reuses user identity, enabling tracking, impersonation, or unexpected linkage of the skill's actions to local credentials.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The history-report trigger phrases are broad enough that ordinary requests about sleep reports could automatically invoke cloud history lookup. In a sensitive infant-monitoring context, this can cause unintended retrieval of prior reports tied to an internal identity, exposing private family data without clear intent confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that uploaded attachments and media are automatically saved as local files, but it does not provide a clear user warning or consent flow for local persistence. Because the content is infant room imagery/video, local storage materially increases privacy risk if files are retained, accessed by other processes, or mishandled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requires direct cloud API queries for historical report retrieval but does not explicitly warn users that sensitive sleep-monitoring data is fetched from or transmitted to a cloud service. In this context, hidden cloud processing of infant-monitoring records can violate user expectations and privacy requirements, especially when identity association is automatic.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI defines a hidden --open-id parameter and then uses it to resolve the current user identity without transparent user-facing disclosure. Hidden identity-affecting parameters can enable unauthorized access to another user's analysis list or data context if callers can supply arbitrary values, and they reduce auditability because users are not clearly informed that identity can be overridden.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads the entire local file and uploads it to the analysis service without any disclosure, confirmation, or visible consent mechanism in this file. Because the skill processes local videos that may contain infants, family members, or the home environment, silent upload creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: A hidden API credential parameter allows secret-bearing input without user-facing disclosure, which can bypass normal transparency and encourage insecure secret handling. Hidden credential channels are risky because users may unknowingly pass sensitive tokens into a skill whose network behavior and storage practices are not clearly documented.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends user-provided video inputs to backend analysis functionality without explicit disclosure in the interface that media may be transmitted off-device. In a baby-monitoring context, this is particularly sensitive because videos may contain infants, caregivers, and home interiors, creating substantial privacy and consent risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `delete` method immediately performs a network POST to a caller-provided URL with no visible confirmation, safety interlock, or contextual validation. In a baby sleep analysis skill, users would not reasonably expect destructive remote actions, so silent deletion capability increases the chance of harmful or deceptive behavior if the method is invoked.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When debug mode is enabled, the code turns on verbose HTTPConnection and urllib3 logging globally. This can expose request metadata and potentially sensitive headers, tokens, or payload contents in logs, especially because the same module later performs authenticated requests and handles identity material.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: Automatically creating a skills directory from inside a utility module is more sensitive than ordinary data-directory initialization because it touches an area associated with code/assets installation. In an agent ecosystem, this can support persistence or modification of the skill environment outside the narrow scope of infant sleep analysis.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2