Unattended Monitoring Skill | 无人陪伴监测技能

• Outcome: Review
• Latest audit: Sep 29, 2026 · 7:10 AM UTC
• Version: 1.0.13

Overview

This skill is an elder-care monitoring tool, but it uploads sensitive home-monitoring media to a cloud service while silently creating or reusing account identity and storing tokens locally.

Review before installing. Use this only if the monitored person and family understand that images or videos may be uploaded to Life Emergence cloud endpoints, reports are account-linked, and local tokens may be stored in the workspace data directory. Prefer explicit confirmation before history lookup or analysis of surveillance footage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to create/resolve identities, read and write workspace data, authenticate users, manage tokens, and perform arbitrary authenticated HTTP methods, all while claiming a narrow elder-care monitoring purpose. This combination is dangerous because it grants a broad authenticated backend surface and local persistence under a misleading high-trust description, increasing the chance of data exposure, account misuse, or unauthorized API activity.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit indicates possible metadata poisoning or suspicious manifest text patterns, and the skill already contains strong behavioral claims that do not align with observed capabilities. Even if the hit is partly heuristic, in a manifest this can be used to manipulate agent routing or reviewer trust, especially when paired with broad capabilities and hidden identity behavior.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "unaccompanied-monitoring-analysis"
description: "Determines when elderly people living alone have no interaction or visitors for extended periods, and actively pushes care reminders to family members, suitable for remote care scenarios for elderly people living alone at home. | 无人陪伴监测技能，判定独居老人长时间无人互动来访，主动推送关怀提醒给家属，适用于居家独居老人远程关怀场景"
version: "1.0.19"
license: "MIT-0"
---

# 👤 Unattended Monitoring Skill | 无人陪伴监测技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implementation is a generic media upload/analysis wrapper with report polling, listing, and export behavior, not a narrowly scoped elderly-monitoring skill. This scope mismatch is dangerous because it can expose broad file-analysis and report-retrieval capabilities under a misleading safety-sensitive label, increasing the chance of unauthorized data processing or misuse in a care context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implementation exposed here performs generic video analysis and history retrieval, but the manifest claims a narrowly scoped elderly-alone monitoring and family-care reminder function. This scope mismatch is dangerous because users or orchestrators may grant the skill access and trust appropriate for a care-monitoring workflow while it actually processes arbitrary video inputs and listing operations, creating a deceptive capability boundary and increasing risk of misuse or overcollection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file implements a broadly reusable API wrapper with generic pagination, CRUD methods, and arbitrary HTTP verbs rather than a narrowly scoped elderly-monitoring integration. In a skill intended only to detect lack of interaction and send care reminders, this excess capability expands the attack surface and could be abused by other components to access or modify unrelated backend resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The http_post/http_put/http_get/http_delete methods accept caller-supplied URLs and forward requests directly, enabling arbitrary outbound network access if an upstream caller can influence the URL. In this skill context, such open-ended connectivity is not justified by the stated monitoring purpose and could facilitate SSRF, data exfiltration, or unauthorized interaction with internal or external services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though the documentation instructs use of shell execution, filesystem access, network access, and likely environment-derived identity handling. In an agent setting, missing least-privilege declarations increases the chance the skill is invoked with broader capabilities than necessary, enabling unintended data access or command execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description does not clearly warn users that the skill involves privacy-sensitive household monitoring and may send automatic notifications to family or community contacts. In this context, inadequate notice undermines informed consent and can lead to unexpected disclosure of an elderly person's living situation and activity patterns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default trigger activates broadly for general monitoring requests, which can cause the skill to process sensitive surveillance content even when the user did not intend this specific elder-care workflow. In an agent environment, overbroad auto-triggering increases accidental collection, unexpected API calls, and privacy violations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The keyword trigger list is broad and lacks exclusion constraints, so benign requests about reports or monitoring could unintentionally invoke cloud history lookup or analysis actions. Because the skill handles sensitive home-monitoring data and account-linked records, accidental activation has elevated privacy impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id without clear user-facing disclosure, and the --open-id parameter is intentionally hidden from help output. In a care-monitoring skill that handles sensitive elderly activity data, silently binding analysis and list retrieval to an internal identity can cause privacy violations, unexpected data access, or actions taken under the wrong account context.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2