Security audit
Security checks for vulnerabilities and agentic risk
This skill analyzes minors' camera footage through cloud APIs and silently creates or reuses persistent identity and token state, so it should be reviewed carefully before install.
Install only if you are authorized to submit the videos to the configured Life Emergence cloud services, have guardian and youth consent, and accept persistent local identity/token storage plus cloud report history. Avoid using it for bedroom, classroom, or other sensitive footage unless retention, deletion, access control, and account ownership are clear.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
The strongest finding is that the skill claims narrow adolescent posture monitoring while the implementation reportedly performs network communication, token/auth handling, local workspace reads/writes, identity creation, and persistence. In a context involving surveillance of minors at home or school, undisclosed identity creation and remote data exchange make the mismatch especially dangerous and privacy-invasive.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-teen-screen-addiction-detection-analysis"
description: "Using fixed cameras at home, study rooms or schools, the system analyzes adolescents' posture while using phones or gaming devices: head pitch angle (downward > 45°) and hand-holding-device posture (hand grasp + bent arm). It counts daily cumulative screen-looking time. | 通过家庭、自习室或学校固定摄像头，分析青少年使用手机或游戏设备的姿势，检测头部低垂角度（俯仰角大于45°）以及手持设备的姿态（手部抓握且手臂弯曲），统计每日累计低头看屏幕的时长。当连续低头时长超过设定阈值（如单�
The skill description lacks an upfront warning that it involves highly sensitive surveillance and cloud reporting of minors' video data. In this context, missing prominent privacy, consent, and data-sharing warnings is especially serious because users may submit intimate home/school footage without understanding the legal and ethical implications.
The User model stores PII such as username, realname, email, birthday, age, and also token/open_token fields, none of which are justified by the camera-based addiction-detection description. In a system focused on adolescents, unnecessary collection of identity and authentication-like secrets significantly raises privacy, abuse, and breach impact.
The code reads an identity value from a workspace file and falls back to generating and persisting a default open-id in a local database, despite that behavior being unrelated to the stated camera-based posture analytics function. This creates undisclosed credential-like state and persistent user tracking, increasing privacy and misuse risk if the workspace or database is accessed by other components.
This utility performs remote account bootstrap/login and local persistence of user identity/token state, which is unrelated to the declared teen posture/screen-time analysis purpose. Such hidden identity provisioning expands the data-processing scope and can transmit or create user-linked records without clear necessity, consent, or minimization.
The helper automatically calls a remote /sys/phoneLogin endpoint with register=1, silent=1, openId, and mobile, meaning it can silently register or log in identities without a justified relationship to the advertised screen-addiction detection capability. This is dangerous because it covertly transmits identifiers off-device and may create remote accounts or audit trails the user never intended.
The skill declares no explicit tool scope even though the surrounding implementation is reported to use filesystem, network, environment, and shell capabilities. That creates an over-privileged execution surface where a consumer cannot easily tell what the skill may access or invoke, increasing the risk of unintended data exposure or abuse.
An overly broad default trigger can cause the skill to auto-run on any qualifying video input, even when the user did not intend sensitive adolescent-monitoring analysis. Because the content involves minors and home/school footage, accidental invocation materially increases privacy risk.
The documentation expands the skill from visual analysis into cloud-based historical report retrieval and link output, which changes the sensitivity and scope of the system. This is risky because users may consent to one-time analysis but not to ongoing cloud history aggregation and retrievable report archives.
Broad history-query auto-triggers may invoke cloud record retrieval on common phrases without ensuring the requester is authorized or intends to access sensitive child-monitoring history. This can expose report metadata or links too easily.
Automatic cloud API access for historical report lookup introduces ongoing remote data access that is not clearly justified by the stated camera-analysis purpose. In a minors context, this broadens the system from analysis to surveillance record management, increasing privacy and misuse risk.
Automatically creating and reusing a default local user identity when no upstream identity is provided is dangerous because it silently binds sensitive reports to a persistent identifier without clear user awareness. With minors' surveillance data, this can enable hidden longitudinal tracking and accidental cross-user data exposure.
Detected: suspicious.install_untrusted_source