Back to skill

Security audit

Unattended Monitoring Skill | 无人陪伴监测技能

Security checks across malware telemetry and agentic risk

Overview

The skill is a Review case because it processes private elder-care footage through remote APIs while silently creating, reusing, and storing user identity tokens without enough consent and endpoint scoping.

Install only if you are comfortable sending household monitoring images or videos, URLs, and identity-linked report requests to the configured backend, and only after confirming consent from monitored people, where reports are stored, who receives reminders, and which production endpoints will be used instead of the bundled dev/private-network defaults.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill manifest advertises no permissions while the documented behavior clearly includes shell execution, local file handling, network access, and likely environment/config access. This creates a trust gap for reviewers and users, and can lead to the skill being approved or invoked without understanding its real access needs.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The stated purpose is narrow monitoring/alerting, but the skill also documents remote uploads, historical report retrieval with report links, local identity creation/reuse, SQLite storage, and backend authentication flows. That mismatch obscures sensitive data processing and persistent identity handling, increasing the chance of undisclosed surveillance, data leakage, or unauthorized account/data access.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The implementation does not match the declared purpose of elderly-alone monitoring and family care reminder workflows; instead it provides a generic file/video analysis and report export interface. This kind of capability mismatch is dangerous because users or upstream systems may trust the manifest and route sensitive elder-care data into a component that lacks the promised safety logic, monitoring semantics, or notification constraints.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The validation helper is described as validating input files, but network URLs bypass those local-file checks and are passed onward as analysis input. Accepting arbitrary remote URLs can enable server-side fetching of untrusted resources, which may expose internal services, process unexpected content, or create trust-boundary confusion for callers who believe all inputs are validated uniformly.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The code implements a generic video analysis and history-listing CLI rather than the declared elderly no-interaction monitoring and family notification workflow. This capability mismatch is dangerous because operators may deploy or trust the skill for a sensitive elder-care use case it does not actually perform, leading to missed welfare checks, incorrect monitoring assumptions, and possible privacy exposure through unrelated video analysis functions.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This class exposes thin wrappers for generic add/edit/delete and arbitrary http_get/http_post/http_put/http_delete operations, allowing callers to reach broadly defined network endpoints instead of a narrowly scoped API for elderly monitoring workflows. In a skill meant for unaccompanied-elderly care reminders, this unnecessary network capability increases the attack surface and could be abused by other components or prompt-influenced logic to perform unintended outbound requests or unauthorized data operations.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code automatically provisions or logs into accounts against an external health service, then persists returned tokens locally, even when the skill's stated purpose is only elderly isolation monitoring and family reminders. That creates undisclosed identity creation, credential handling, and cross-service data linkage that could expose users to unauthorized account activity and privacy violations.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The workspace and agent-environment discovery logic enumerates runtime layout and locates data/skills directories beyond what is needed for a simple monitoring/reminder skill. In a plugin ecosystem, this broad environment awareness increases the blast radius for data access, persistence, and potential interference with other agents or workspaces.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This utility implements broad remote API handling, identity resolution, token reuse, local persistence, and retry logic that substantially exceeds the declared elderly-monitoring use case. Such generalized capabilities make the skill able to communicate with unrelated services and manage identities in ways users would not reasonably expect, increasing risk of covert data exfiltration and account misuse.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger says the skill should activate whenever a user provides monitoring footage needing unattended-detection, which is broad enough to cause automatic analysis without clear confirmation. In this context, that can lead to unsolicited processing of in-home surveillance content and downstream notifications to family or staff.

Vague Triggers

Medium
Confidence
83% confidence
Finding
Keyword activation includes broad phrases related to care, monitoring, and history lookup, which may trigger analysis or cloud report retrieval from casual mentions rather than deliberate requests. Because the skill handles sensitive home-monitoring data and historical records, overbroad activation materially increases privacy and misuse risk.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill processes highly sensitive in-home surveillance data about elderly individuals and may notify third parties, yet the description lacks a clear privacy warning or consent boundary. In this setting, missing disclosure is especially dangerous because it normalizes covert monitoring, remote uploads, and family/community escalation without transparent notice.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The code transmits local file contents or user-supplied video URLs to an external analysis path without any visible notice, consent flow, or disclosure in this component. In the context of elder-care monitoring, this is more sensitive than usual because videos may contain highly private health, behavioral, and household information about vulnerable individuals.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The file utility exposes arbitrary file opening for write mode and directory creation without any disclosure or apparent path restrictions. In an agent workspace, that can enable silent local state changes, overwriting files, or persistence of unexpected artifacts if higher-level code passes attacker-influenced paths.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Reading an internal identity value from a workspace file without user disclosure creates an opaque authentication path and may cause the skill to act under a stored identity the user did not intentionally select. In this context, that is especially sensitive because later code uses the value to authenticate outbound requests.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The HTTP helper automatically attaches tokens, API keys, and user identifiers to outbound requests and can send them to composed URLs, without any user-facing disclosure in this code. Because the skill context is a home-care monitoring tool, hidden transmission of authentication and identity data is more dangerous due to the likely presence of sensitive health-adjacent user information and trust expectations.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
93% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:jpg/jpeg/png/mp4/avi/mov,最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供关怀提醒参考,不能替代人工探望和专业护理 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
68% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "unaccompanied-monitoring-analysis"
description: "Determines when elderly people living alone have no interaction or visitors for extended periods, and actively pushes care reminders to family members, suitable for remote care scenarios for elderly people living alone at home. | 无人陪伴监测技能,判定独居老人长时间无人互动来访,主动推送关怀提醒给家属,适用于居家独居老人远程关怀场景"
version: "1.0.14"
license: "MIT-0"
---
Confidence
71% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2