ClawHub
Back to skill

Security audit

Child Learning Behavior Analysis Tool | 孩子学习行为分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill performs child learning-video analysis, but it also silently creates or reuses identity records, stores tokens locally, and retrieves cloud history without clear user control.

Review carefully before installing. The skill sends child/student media or video URLs to lifeemergence.com cloud APIs, links results to an internal identity, can retrieve prior cloud reports, and may silently create/login an account while storing tokens in a workspace SQLite database. Install only if that identity linkage, cloud processing, and local token persistence are acceptable for the child media involved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (23)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to use shell, local file handling, network access, and possibly environment-backed identity handling, but the manifest does not declare corresponding permissions or constraints. This creates a capability/transparency gap: a host may expose more power than users or policy reviewers expect, increasing the risk of unintended file access, command execution, or network exfiltration.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The workflow says uploaded attachments and media are automatically saved as local files, while the privacy section claims raw videos are deleted after analysis and not persistently stored. That inconsistency is dangerous because users may rely on the privacy promise even though local copies may remain on the agent host, creating exposure of children's sensitive videos.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill says users must not be asked for identity information, yet the privacy section states the system derives identifiers from username or phone number. For a child-focused analysis tool, this creates a meaningful privacy and consent risk because identity linkage is occurring implicitly without clear, consistent disclosure or data-minimization boundaries.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The CLI silently resolves an internal user identity via OpenIdUtil.resolve_current_open_id and exposes a --list mode that retrieves prior analysis records, which exceeds the advertised purpose of analyzing a supplied video. In a child-study-behavior context, hidden identity binding and history retrieval can disclose sensitive behavioral data for the current internal account without clear user awareness or consent, creating a privacy and authorization risk.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This class exposes broad generic network primitives and CRUD-style wrappers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, `list`) that can send requests to caller-supplied URLs, which substantially exceeds the stated purpose of analyzing study-behavior videos. In an agent skill context, such unrestricted HTTP capability can be repurposed for arbitrary outbound requests, data exfiltration, or access to unintended internal/external services if higher-level controls are weak or bypassed.

Context-Inappropriate Capability

Low
Confidence
82% confidence
Finding
The `get_user_by_username` helper introduces an identity lookup capability that is not justified by the manifest's learning-behavior video analysis scope. Even if intended for convenience, unnecessary user-enumeration functionality expands the skill's access surface and may enable privacy violations or account discovery when combined with other components.

Description-Behavior Mismatch

Medium
Confidence
79% confidence
Finding
The file implements generic user/account persistence, including identity records and user selection logic, which is not clearly required for a skill advertised as children's learning-behavior video analysis. In a high-sensitivity child-focused context, collecting and persisting extra account data expands the attack surface and increases privacy/compliance risk if the data is later exposed, reused, or mishandled.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The model stores authentication-like material such as token and open_token alongside personal identifiers including username, realname, email, birthday, age, and sex, without any visible protection such as encryption, hashing, minimization, or purpose limitation. In a child/student analysis skill, unnecessary storage of sensitive identity and token data is especially dangerous because database compromise could expose both account access artifacts and personal data of minors.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The file defines a generic `ai_chat(prompt, session_id, timeout)` helper in shared skill code even though the skill manifest describes a narrowly scoped study-behavior video analysis tool. This capability widens the effective authority of the skill and can enable arbitrary prompt forwarding or off-purpose model use if other components invoke it, which is especially concerning in a child-focused context where sensitive educational or behavioral data may be processed.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring claims subprocess-based invocation of an external `openclaw agent`, but the implementation does not execute such a command and instead returns from a stubbed path. This mismatch is dangerous because reviewers and downstream callers may trust a behavior, isolation boundary, or audit trail that does not actually exist, leading to incorrect security assumptions and unsafe integration decisions.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility performs token-backed API authentication, user lookup, and automatic account provisioning logic that is unrelated to the declared purpose of study-behavior video analysis. This creates hidden identity, session, and backend access behavior that can send user-linked data to external services and expand the skill's effective privileges beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code inspects workspace environment state and later uses workspace-derived paths to locate identity material, despite the skill being described as an educational video-analysis tool. Pulling identity context from environment/workspace metadata increases the chance of covert user tracking or unintended cross-context identity reuse.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code can generate synthetic default user identifiers, create local user records, and persist them without the user's involvement. For a study-analysis skill, silently creating durable identities is risky because it enables undisclosed tracking, account linkage, and backend actions under fabricated or implicit identities.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger condition is broad enough to activate on generic mentions of child study videos or related topics, without strong scoping or confirmation. Overbroad activation can cause unintended processing of sensitive student/child media, accidental uploads, or unnecessary transmission to a cloud API.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The automatic history-report trigger relies on broad everyday phrases and mandates immediate cloud API access. In a privacy-sensitive context involving children's learning reports, this can surface historical data without sufficient disambiguation, risking unauthorized or accidental disclosure of prior reports.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code sends either a local video path or remote URL to skill.get_output_analysis for external processing without any prominent warning, consent flow, or data-handling disclosure. Because this skill analyzes children/students and infers learning habits and behavior, the transmitted material is highly sensitive; users may unknowingly upload minors' videos and derived behavioral data to a remote service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill reads arbitrary local file contents and forwards them to an external analysis API without any user-facing disclosure, consent flow, or data-minimization control in this code path. Because the skill handles videos of children/students, the privacy sensitivity is elevated: users may unknowingly upload highly sensitive personal data, creating confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script accepts a hidden `--api-key` argument while suppressing it from `--help`, which can cause users or operators to unknowingly pass secrets via command-line arguments. Command-line credentials are commonly exposed through shell history, process listings, audit logs, and job runners, and hiding the parameter reduces transparency rather than reducing exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The function reads an internal identity value from data/smyx-api-key.txt and treats it as an open-id source with no user-facing notice. Reading sensitive identity material from local workspace files without disclosure can surprise users and allows the skill to act under a stored identity they did not knowingly provide for this feature.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The request flow silently performs authentication bootstrap and may register or log in a user by calling /sys/phoneLogin with register=1 and silent=1. Automatic account creation and authentication without clear disclosure is dangerous because users may unknowingly trigger backend account establishment and token issuance simply by invoking a purportedly local study-analysis skill.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
## ⚠️ 注意事项 | Notes
| 分类 | 注意事项 |
|---|---|
| 🧑‍⚖️ 结果性质 | **重要声明**：本分析仅供家庭教育参考，不能替代专业老师或心理咨询师诊断。发现严重学习困难建议及时寻求专业帮助 |
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
Confidence
77% confidence
Finding
‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "study-analysis"
description: "Conducts video analysis of learning behavior for children/students, identifies poor learning habits, provides structured analysis reports and family education improvement suggestions, focusing on learning habit cultivation and behavior correction. | A comprehensive tool designed to analyze video footage of children's and students' learning behaviors. It identifies poor study habits and provides structured analysis reports along with actionable suggestions for family education improvements. The tool is dedicated to fostering positive study habits and facilitating behavioral correction. | 分析孩子学习行为 孩子学习行为分析工具，针对孩子/学生的学习行为进行视频分析，识别不良学习习惯，提供结构化分析报告和家庭教育改善建议，专注学习习惯培养和行为矫正"
version: "1.0.11"
license: "MIT-0"
---
Confidence
70% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2