ClawHub
Back to skill

Security audit

Sleep Quality Analysis Skill | 睡眠质量分析技能

Security checks across malware telemetry and agentic risk

Overview

This skill has a legitimate sleep-analysis purpose, but it handles sensitive sleep media through cloud APIs while silently creating/reusing account identity and local token storage.

Review this skill before installing. It may upload sleep videos or remote video URLs to lifeemergence.com services, query cloud-stored report history, create or reuse a local account identity, and store tokens/profile data in a workspace SQLite database. Install only if you trust the publisher and are comfortable with cloud processing of sensitive sleep-monitoring media and account-linked history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
This method applies filter keys from an external dictionary directly via getattr(self.__model__, key) with no allowlist. An attacker who can influence filters may trigger exceptions, probe model internals, or access unintended ORM attributes, creating a query-manipulation and denial-of-service surface. In a shared DAO used across skills, this is more dangerous because many callers may pass partially trusted filter objects.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
The count() method repeats the same unsafe dynamic attribute selection from caller-supplied filter keys without validation. While not direct SQL injection through SQLAlchemy, it can still expose unintended model attributes and cause controlled failures or abnormal query behavior if untrusted input reaches this path.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and instructs use of shell execution, file reads/writes, network access, and environment-dependent behavior without declaring permissions or trust boundaries. That mismatch increases the chance an agent or reviewer underestimates the skill’s ability to access sensitive local data or transmit sleep-monitoring content to remote services.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The documented scope expands from sleep analysis into cloud-based historical report querying and report-link retrieval, which introduces additional data exposure and account-linkage behavior not obvious from the primary skill purpose. Expanding functionality in documentation can cause an agent to access remote report inventories or links when the user expected only local/video analysis.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The documented endpoints and scenario code are for pet health analysis, which conflicts with the declared sleep-quality-analysis skill. This kind of domain mismatch can cause the agent or integrators to call the wrong backend, expose unrelated health-report export functionality, and mishandle sensitive data under false assumptions about what the skill does.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill exposes a user-specific analysis listing function that is not necessary for one-shot sleep-quality analysis and can reveal prior analysis history tied to an internal identifier. In a health-related context, this increases privacy risk because the returned list may disclose sensitive behavioral or medical-adjacent information about a user without clear need or consent flow.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code initializes internal identity resolution in a media-analysis CLI even though the user-facing interface does not clearly describe account linkage. Hidden or implicit identity handling in a health-analysis workflow can cause unintended association of uploaded sleep data and history with a user account, creating privacy and data-governance risk.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The implementation accepts arbitrary local video files or remote video URLs and forwards them to a generic analysis backend, while the skill is presented as a narrowly scoped sleep-quality analysis capability. This scope mismatch is dangerous because it enables broader data processing than users would reasonably expect, increasing the chance of unintended surveillance, sensitive-content processing, or policy bypass under a health-oriented label.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code allows users to supply any http/https URL, which the backend will then analyze via the videoUrl parameter. In a narrowly scoped sleep-monitoring skill, this creates an unjustified arbitrary external-content ingestion channel that can be used to analyze unrelated or sensitive third-party content and may also introduce backend fetch/privacy risks depending on how the service resolves URLs.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
This file exposes generic CRUD and raw HTTP helper methods that can send arbitrary requests to caller-supplied URLs, which is far broader than the declared sleep-quality-analysis purpose. In an agent skill context, this creates reusable network and remote action primitives that could be repurposed for unauthorized data access, data exfiltration, or modification of external services if higher-level code passes untrusted endpoints or payloads.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The http_post/http_put/http_get/http_delete helpers provide arbitrary remote resource interaction, including destructive actions, with no visible restriction on destination, method use, or payload shape. In a skill that should analyze sleep stages, these capabilities materially expand the attack surface and could be abused as a generic network proxy or remote manipulation layer.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This sleep-analysis skill ships a shared DAO that persists user-account records, which is not clearly necessary for sleep-stage analysis. The mismatch between declared functionality and retained identity data increases privacy and insider-misuse risk, especially in an agent ecosystem where shared modules may be reused broadly and data can accumulate beyond the user's expectations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The model stores authentication-like tokens together with personal profile attributes such as real name, email, birthday, age, and sex, without an evident need for sleep-quality analysis. If the local shared SQLite database is accessed by another component or exfiltrated, these fields enable both account compromise and sensitive personal-data exposure. In this skill context, the collection is harder to justify, so the mismatch makes the issue more serious.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill exposes a general-purpose `ai_chat` capability that is unrelated to the advertised sleep-quality-analysis function, which expands the skill's attack surface and creates a hidden secondary behavior. In an agent/skill ecosystem, undocumented chat or agent-invocation features can be abused for prompt injection, policy bypass, or unauthorized data handling even if this specific implementation is currently incomplete.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring states that the method invokes an external agent via `subprocess`, but the actual code does not do so and instead contains commented-out execution logic plus placeholder behavior. This mismatch is dangerous because it obscures the true runtime behavior, can mislead reviewers, and may indicate latent or intentionally disabled command-execution functionality that could be re-enabled later without proper scrutiny.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code performs identity resolution, automatic account provisioning, token acquisition, and authenticated external API access that are unrelated to the advertised sleep-analysis function. In skill context, this is dangerous because installing or invoking a sleep-monitoring skill could silently create or reuse accounts and transmit user-linked identifiers and tokens to external services without clear consent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code implicitly resolves identity by reading a workspace file and falling back to a local user database, then persists the chosen identity globally. That can cause silent cross-context identity reuse and unintended access under another local user's credentials, especially in a multi-agent or shared workspace environment.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The workspace-detection helpers inspect environment variables and filesystem layout, then create data and skills directories automatically. For a sleep-analysis skill this broad workspace introspection and modification exceeds expected scope and increases the blast radius for data exposure, persistence, or unintended changes to agent environments.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Overly broad trigger phrases for historical report lookup may cause unintended cloud queries when users make ordinary conversational requests mentioning reports or history. In a health-related context, that can expose sensitive report metadata or links without clear intent verification.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill handles highly sensitive health-adjacent sleep-monitoring videos and reports, yet the documentation does not clearly warn users that media may be saved locally and/or transmitted to a cloud API. Lack of explicit disclosure and consent for storage and remote processing materially raises privacy, compliance, and data-leak risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Identity resolution and account-linked list retrieval are hidden from normal user-facing help and disclosure, which undermines informed consent and makes it easier for users to trigger account-scoped operations unknowingly. Because the skill processes sleep data, the privacy sensitivity of this hidden behavior is higher than for generic media tooling.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The function sends local file paths or URLs to a network-backed analysis routine without clearly warning users that their sleep recordings or derived health-related data may be transmitted to a remote service. In a sleep-monitoring context, this can expose highly sensitive personal data and create compliance, consent, and confidentiality issues.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill reads the full contents of a local file and uploads it to the analysis service without any visible notice, consent step, or contextual warning in this code path. For a health-related skill, this is especially sensitive because uploaded videos may contain intimate biometric, bedroom, or medical-context data that users may not realize is being transmitted off-device.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The script accepts a hidden --api-key argument via argparse.SUPPRESS, meaning sensitive credential handling is intentionally concealed from normal help output while still permitting secret input on the command line. Command-line secrets are commonly exposed through shell history, process listings, logs, and orchestration tooling, so hiding the parameter reduces transparency without reducing exposure. In this skill context, that is more concerning because the tool is presented as a benign sleep-analysis skill while actually operating as a generic analysis wrapper that may process external content and backend credentials.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Debug mode enables low-level HTTPConnection and urllib3 logging, which can expose request URLs, bodies, headers, tokens, and response contents in logs. Because this same module handles authentication and external requests, the debug setting materially increases the chance of credential or sensitive data leakage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2