ClawHub
Back to skill

Security audit

Infant Suffocation Risk Detection | 婴幼儿趴睡窒息风险识别

Security checks across malware telemetry and agentic risk

Overview

The skill broadly matches infant video risk analysis, but it also uses cloud services with silent account creation, identity reuse, history retrieval, and locally stored tokens for very sensitive child-monitoring data.

Install only if you are comfortable sending infant video or video URLs to the publisher's backend and with the skill silently creating or reusing an account identity, storing tokens locally, and retrieving cloud report history. Prefer a version that requires explicit consent before uploads/history access and clearly documents retention, account creation, token storage, and report-link security.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
87% confidence
Finding
This query builder uses getattr(self.__model__, key) on filter keys supplied by the caller, allowing unvalidated dynamic access to model attributes. While SQLAlchemy prevents classic SQL injection here, an attacker controlling filters can trigger unauthorized field-based queries, bypass intended business restrictions, or cause crashes by referencing unexpected attributes.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
87% confidence
Finding
As in list(), count() accepts arbitrary filter keys and resolves them dynamically against the ORM model. If external input reaches this method, it can expose metadata about restricted fields, enable unintended record enumeration, or produce exceptions that leak internal structure.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises significant capabilities including shell execution, network access, file reads/writes, and environment access, but does not declare permissions or bound them in the manifest. That creates a transparency and least-privilege problem: operators may approve a seemingly simple infant-monitoring skill without realizing it can access local files, invoke commands, and communicate with remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is infant sleep-risk detection, but the behavior reportedly includes persistent identity creation, local token storage, remote account/session handling, historical report retrieval, and generic file/URL submission. This mismatch is dangerous because it hides sensitive data handling and account-linking behavior behind a safety-themed skill, increasing the risk of privacy violations, unauthorized data retention, and exfiltration of highly sensitive infant video and user metadata.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The documentation broadens the skill from live suffocation-risk detection into cloud historical-report queries and report-link retrieval. In the context of infant monitoring, that scope expansion matters because it may expose sensitive records and media-derived report links without users understanding that the skill is accessing cloud history rather than only analyzing the provided live input.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The function exposes retrieval of prior analysis records by internal user/open ID, which goes beyond the stated purpose of real-time infant suffocation-risk detection. In a baby-monitoring context, these records may contain sensitive video-derived safety events or metadata about an infant, so unnecessary listing capability increases privacy and data-access risk if invoked by unauthorized users or reused in broader tooling.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code resolves and uses an internal open_id while hiding the parameter from normal CLI help, creating a covert identity-dependent behavior that users and reviewers may not notice. In the context of infant video analysis, tying operations to a hidden internal identity can enable unauthorized access to another user's sensitive monitoring history or account-scoped data, making the privacy implications more severe.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill accepts arbitrary HTTP(S) video URLs, which broadens it from analyzing footage from a fixed baby monitor to fetching remote content from anywhere. In a childcare context this can enable unexpected external data ingestion, privacy exposure, and misuse of the service beyond the stated purpose without any apparent restriction to trusted monitor sources.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The report-listing function exposes historical analysis records, which is outside the manifest's core real-time suffocation-risk detection workflow. In a health/infant-monitoring setting, access to prior reports can reveal sensitive childcare data and expands the accessible surface beyond what users may expect from this skill.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This shared utility performs remote identity resolution, token management, local user persistence, and automatic account bootstrapping that are unrelated to infant suffocation-risk detection. In the context of a baby-monitor safety skill, hidden authentication and external service coupling materially expand the attack surface and can transmit user identity or telemetry off-device without necessity or clear consent.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code silently calls a remote /sys/phoneLogin endpoint with register=1 and user identifiers, effectively creating or reusing accounts without an explicit user action. For a skill advertised as infant posture and occlusion detection, covert account registration is unjustified and could expose personal identifiers, create unwanted service accounts, and establish persistent linkage to the user.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This code reads identity material from a workspace file, searches and reuses local database user records, and persists a generated default open-id for future reuse. That creates cross-skill identity persistence unrelated to the stated monitoring function, increasing privacy risk and enabling silent correlation of activity across sessions or skills.

Vague Triggers

Medium
Confidence
78% confidence
Finding
A default trigger that activates whenever a crib-monitor video is provided is overly broad for a skill that handles sensitive child video. Over-triggering can cause unintended processing and transmission of infant footage, especially if users did not explicitly request this specific analysis or understand that cloud/backend services may be involved.

Vague Triggers

Medium
Confidence
82% confidence
Finding
Broad keyword-based automatic triggering of historical report queries can expose or retrieve sensitive infant monitoring records based on ambiguous user phrasing. Because the skill also appears to use internally resolved identities and cloud retrieval, accidental triggering could leak private report metadata or links without sufficiently explicit authorization intent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document explicitly requires 24-hour infant video collection and exposes a snapshot URL output, but provides no privacy, retention, access-control, or secure-handling guidance for highly sensitive recordings of a child. In the context of always-on nursery monitoring, this omission materially increases the risk of unauthorized access, over-collection, unsafe sharing, or long-term storage of intimate household imagery.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The API documents exporting full reports without any warning that the exported data may contain sensitive infant health-event history, timestamps, and potentially linked imagery. Without downstream handling requirements, exported files can be copied, emailed, or stored insecurely, creating privacy and compliance exposure beyond the primary system boundary.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code submits remote video URLs or uploaded video content to a backend analysis service without any visible user-facing warning, consent flow, or disclosure in this file. Because the content involves infant sleep footage, the absence of explicit transparency raises privacy and safety concerns and increases the risk of users unknowingly sending sensitive recordings off-device.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The script accepts a hidden --api-key parameter that is suppressed from help output, reducing transparency around secret handling and network use. Hidden credential parameters can lead users or integrators to pass secrets on the command line, where they may be exposed via shell history, process listings, logs, or wrapper tooling.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The utility performs outbound requests and possible user registration automatically, with no evidence of user-facing disclosure or consent in this code path. Silent network actions are especially problematic in a child-safety monitoring skill because users may reasonably expect local analysis rather than hidden backend enrollment.

Missing User Warnings

Low
Confidence
85% confidence
Finding
Reading an identity value from data/smyx-api-key.txt without clear disclosure or validation creates a quiet trust channel for local identity material. While not as severe as the remote registration flow, it can still lead to unexpected identity reuse and privacy leakage if the file is stale, shared, or user-unaware.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
The requests.post call sends user/account-related data to an external service endpoint. External transmission is not inherently unsafe, but here it is tied to silent login/registration behavior outside the skill's declared infant-risk-detection purpose, making the data flow unjustified and privacy-relevant.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2