Security audit

Infant Suffocation Risk Detection | 婴幼儿趴睡窒息风险识别

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a cloud-based infant video analysis tool, but it ships with risky identity, history, credential, and plaintext network behavior that needs review before installation.

Install only after confirming you are comfortable uploading infant videos to this provider, using automatic account identity/history features, and accepting local credential persistence. The publisher should switch release configuration to HTTPS production endpoints, remove silent credential storage or use a secure secret store, narrow triggers, and clearly document consent, retention, and history-access controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/config-dev.yaml:2
Finding: Sensitive infant media and authentication credentials transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:580
Finding: Reusable authentication tokens persisted unencrypted in a workspace SQLite database
Content: View full analysis
T: session = self.get_session() try: session.add(model) session.commit() session.refresh(model) return model finally: session.close() ``` ```python # skills/smyx_common/scripts/dao.py class User(Base, BaseModelMixin): __tablename__ = "sys_user" id = Column(String(32), primary_key=True, index=True) source_id = Column(String(32), comment="source identifier") username = Column(String(100), unique=True, index=True, nullable=False) realname = Column(String(200), unique=True, index=True) email = Column(String(45), unique=True, index=True) birthday = Column(DateTime, u ...[truncated 2792 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a baby-monitor risk detector, but the underlying behaviors include remote API communication, automatic account/login flows via phone/openId, local filesystem access, token management, and workspace manipulation. These undeclared capabilities materially expand the blast radius from simple analysis to identity handling and persistent data access, which is particularly concerning when processing infant-related media and history.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code derives a persistent identity from workspace files and a local database, and will create a fallback identity if one is missing. For a baby-monitor video analysis skill, silently resolving and persisting user identity is out of scope and increases privacy risk, especially because that identity is later used in remote requests and account registration flows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility implements generic account provisioning and arbitrary HTTP request functionality that is much broader than the declared infant suffocation-risk detection purpose. It can authenticate, attach tokens, inject user identifiers into requests, and send data to configurable endpoints, creating an unnecessary capability for external communication and account actions that could be repurposed to exfiltrate data or operate outside user expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope even though the documented behavior relies on shell execution, filesystem access, environment/config handling, and network calls. This creates an unnecessary trust gap: a reviewer or runtime may not understand the true privileges required, increasing the chance of overbroad execution and abuse if the script or its dependencies are compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest presents the skill as a real-time infant risk detector, but the documented operation centers on file/URL submission and cloud report queries. This misleading integration surface can cause unsafe assumptions about immediacy and reliability of alerts in a context where delayed analysis may have serious consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default trigger is broad enough to activate on essentially any uploaded crib video, which can cause unexpected processing of sensitive infant footage. Over-triggering is more dangerous here because the content involves minors and may be sent to remote analysis services without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes cloud history querying and automatic reuse/creation of a local user identity that are not justified by the core purpose of visual suffocation-risk detection. In context, these hidden account-linkage features create unnecessary privacy and access-control risk around infant monitoring records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The automatic history-report trigger uses a broad keyword list, making it too easy to invoke retrieval of prior infant-monitoring reports without deliberate, context-specific intent. Because these reports are likely identity-linked and privacy-sensitive, accidental triggering can expose metadata or report links to the wrong context or user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script exposes a hidden --list mode that retrieves analysis history via show_analyze_list(open_id) even though the skill is presented as a real-time infant video analysis tool. That creates an undocumented secondary data-access function which can expose prior user analysis records and expands the attack surface beyond the declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code accepts a hidden open_id parameter and uses global identity state (ConstantEnum.CURRENT__OPEN_ID) to fetch data, despite the stated purpose being local/URL-based infant video risk analysis. Hidden identity handling without clear disclosure or access-control context can enable unauthorized access to another user's records or silent tracking of user activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) performs internal identity resolution without user-facing disclosure and before normal operation checks. In a monitoring skill handling sensitive infant-related data, undisclosed identity resolution increases privacy risk and may silently bind execution to an internal account context.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response