ClawHub
Back to skill

Security audit

Pregnant Prolonged-Standing / Over-Fatigue Detection | 孕妇久站/过度劳累识别

Security checks across malware telemetry and agentic risk

Overview

The skill’s main purpose is understandable, but it handles sensitive pregnancy home-video through cloud services while silently creating or reusing identity state and stored tokens.

Install only if you are comfortable with cloud processing of pregnancy-related home camera footage, automatic cloud history lookup, and persistent local identity/token storage. Users should require explicit consent from the pregnant person, clear deletion/retention terms, and endpoint/account handling details before using it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
80% confidence
Finding
This query builder accepts filter keys and passes them into getattr(self.__model__, key) without validating that the requested field is in an approved set. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still query on unintended model attributes or sensitive columns, enabling overbroad data access and weakening authorization boundaries if higher layers pass user-controlled filters.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
As with list(), count() accepts arbitrary filter keys and resolves them dynamically against the model. If upstream input is user-controlled, this can expose metadata about records matching sensitive attributes and support enumeration or inference attacks even without direct row disclosure.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises sensitive video analysis but declares no permissions while instructing use of shell execution, local file handling, network access, and implicit identity/state management. In a privacy-sensitive health context, this under-disclosure prevents informed review and can hide data flows involving local storage and remote transmission of intimate camera footage and report metadata.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is posture-fatigue analysis, but the skill also describes automatic identity creation/reuse, backend login/registration, token acquisition, cloud history retrieval, and export of prior report links. That mismatch is dangerous because users may consent to video analysis without realizing the skill creates persistent identifiers and accesses historical cloud data tied to a person, especially for pregnancy-related records.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code explicitly accepts arbitrary http/https URLs as video input and forwards them for analysis, which expands the skill beyond the stated fixed-home-camera/local-video use case. This can enable analysis of third-party or attacker-controlled remote media, increasing privacy, consent, and data-sourcing risks, and may also expose backend services to unsafe remote fetch behavior depending on how the downstream analysis service handles URLs.

Description-Behavior Mismatch

Low
Confidence
81% confidence
Finding
The script exposes a history-listing function for prior analyses via `--list` and `skill.get_output_analysis_list(open_id=...)`, but the manifest describes only single-video posture/fatigue analysis. In a health-related camera skill, access to prior analysis history can reveal sensitive behavioral data, so undocumented history access expands the data-access surface and can enable privacy violations if authorization is weak downstream.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code imports and uses an `open_id`-based identity mechanism and later resolves a current ID to retrieve analysis history, but that identity/data linkage is not clearly justified by the stated posture-analysis purpose. Because this skill processes pregnancy-related posture data from home cameras, tying records to an identifier raises the risk of unauthorized access to sensitive personal and health-adjacent history if IDs are guessable, reused, or insufficiently authenticated.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This file exposes generic HTTP wrapper methods (http_post/http_put/http_get/http_delete) that can send requests to arbitrary caller-supplied URLs, which is substantially broader than the stated purpose of posture/fatigue analysis. In a skill handling sensitive pregnancy-related monitoring data, such unrestricted network capability increases the risk of unauthorized data exfiltration or unintended interaction with external services if higher-level code passes untrusted endpoints.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The add/edit/delete helper methods provide broad remote modification capability through generic POST operations without any visible scope restriction tying them to the pregnancy posture use case. Even though they are convenience wrappers, they enable state-changing requests to arbitrary endpoints and therefore expand the attack surface beyond what users would reasonably expect from a health-reference camera analysis skill.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The file defines a generic sys_user table that stores usernames, real names, email, birthday, age, and especially token/open_token fields, which is broader than what a posture/fatigue reminder skill appears to require. In this skill context, collecting and persisting identity and authentication data alongside health-adjacent monitoring increases privacy risk and breach impact without clear necessity.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility performs authenticated backend access and even account provisioning logic that is not justified by the declared purpose of posture/fatigue analysis from a home camera. The mismatch is dangerous because a seemingly local health-analysis skill can silently create remote accounts, obtain tokens, and transmit user-linked identifiers to external services, expanding the data-handling and trust boundary without clear necessity.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code reads a workspace identity file and, if absent, creates and persists a synthetic default user identity for future reuse. For a pregnancy posture-monitoring skill, this creates hidden identity state and enables subsequent authenticated activity under a persistent identifier without clear user awareness, which can facilitate tracking and unintended account linkage.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The workspace-discovery code inspects runtime paths, environment variables, and creates data/skills directories across the agent workspace. In a skill whose stated role is camera-based fatigue assessment, this broad filesystem and workspace awareness is unnecessary and increases the blast radius for data access, persistence, and cross-skill interference if abused or combined with other flaws.

Vague Triggers

Medium
Confidence
86% confidence
Finding
A default trigger that runs whenever a home camera video is provided is overly broad for a skill processing highly sensitive household footage. It increases the chance of unintended analysis and transmission of videos containing pregnant individuals or other family members without clear, situation-specific user intent.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The keyword triggers include broad pregnancy-health terms that may invoke the skill even when the user is seeking general advice rather than consenting to video analysis. In this context, over-triggering is risky because it can cause processing of intimate health-related media or initiation of related workflows without sufficiently specific intent.

Vague Triggers

Medium
Confidence
90% confidence
Finding
Automatically querying historical reports based on broad natural-language phrases can expose prior pregnancy-related analyses from the cloud without strong disambiguation or a fresh consent step. Because these records concern sensitive maternal health and home monitoring, accidental retrieval or display could disclose private history to an unintended viewer or session participant.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill states that uploaded media will be automatically saved as local files, but does not clearly disclose retention, storage location, access controls, or deletion behavior. Since the media may contain a pregnant woman inside her home, silent local persistence materially increases privacy and breach risk if the host, logs, backups, or other processes are compromised.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill does not clearly warn users that certain phrases will automatically trigger a cloud API query for historical reports. That omission is dangerous because users may unknowingly cause remote access to sensitive pregnancy-monitoring records and linked report URLs, undermining informed consent and transparency.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
For local files, the skill reads the full video content into memory and submits it to an external analysis API via self.analysis() without any visible warning, consent prompt, or data-minimization control in this code path. Because the content is intimate health-related home camera footage of a pregnant woman, silent upload materially raises privacy and compliance risk beyond an ordinary media-processing workflow.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The CLI accepts a hidden `--api-key` parameter suppressed from help output, meaning credentials may be provided or consumed without clear user disclosure. Hidden credential paths make misuse harder to detect, complicate auditing, and can lead users or integrators to pass secrets insecurely on the command line where they may be exposed via shell history or process listings.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt without any visible notice, consent, or explanation to the user. Even if intended for convenience, silent reuse of workspace secrets in a consumer health-related skill undermines transparency and can bind the skill's actions to an internal account unexpectedly.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This block silently performs phone-login style registration/authentication against an external service, with fields such as openId and mobile populated from the local username. Automatic remote account creation in the background is dangerous because users of a posture-detection skill would not reasonably expect enrollment or identity propagation to a backend service.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The general request wrapper attaches tokens, API keys, tenant metadata, and a username-derived identity to outbound requests without any user-facing disclosure in this module. In the context of a pregnancy-related monitoring skill, undisclosed transmission of identifiers and auth material materially increases privacy and trust risk, especially if camera-derived events are later tied to those identities.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
This request transmits identifiers to an external phoneLogin endpoint to create or retrieve an account, which is not necessary for the stated local posture-fatigue detection purpose. In the context of a pregnancy-related skill, unnecessary external transmission is more sensitive because it can link intimate health-adjacent usage to persistent backend identities without clear user expectation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2