Pet Adaptive Drying Temperature Recommendation | 宠物烘干温度自适应推荐

• Outcome: Review
• Latest audit: Aug 27, 2026 · 7:31 AM UTC
• Version: 1.0.10

Overview

The skill appears to provide the advertised pet drying analysis, but it also silently creates or reuses cloud-linked identity state and stores/transmits tokens and media with limited user control.

Install only if you are comfortable with pet images or videos being sent to the configured cloud service and with the skill automatically creating or reusing an internal account identity. Before production use, require explicit permission disclosure, user confirmation before uploads/history queries, fixed public API endpoints, and a safer token storage or deletion model.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 84% confidence
• Finding: This dynamic getattr(self.__model__, key) uses filter keys supplied at runtime without validating that the requested field is an approved column. While SQLAlchemy still parameterizes values and prevents classic SQL injection, an attacker who can influence filters may query on unintended model attributes, trigger exceptions for invalid names, or bypass intended business restrictions by filtering on sensitive/internal fields.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 84% confidence
• Finding: The count() method repeats the same unvalidated dynamic attribute lookup pattern on caller-controlled filter keys. This can expose internal schema details through errors or enable unauthorized counting/enumeration on fields that should not be queryable, especially if surfaced through an API.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises no declared permissions, yet its documented behavior clearly involves shell execution, network access, local file read/write, and likely environment use. This creates a transparency and least-privilege problem: operators or users cannot accurately assess what the skill can do, while the skill can still process local files, reach remote services, and persist data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to only analyze pet media and return drying recommendations, but the documented behavior extends to local identity creation, backend login, token storage/reuse, history retrieval, and generic remote AI scene processing. This mismatch is dangerous because it conceals authentication, persistence, and broader cloud-side data handling that materially changes the trust and privacy model.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documentation expands the skill from one-shot analysis into cloud-based historical report retrieval, which introduces additional data access and account-linked behavior outside the manifest’s main scope. Hidden expansion of scope increases the chance of users unintentionally exposing prior records or invoking remote queries they did not expect.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The documentation says uploaded attachments and media are automatically saved locally, but this storage behavior is not clearly reflected in the stated skill scope. Undisclosed local persistence can expose sensitive user media to later access, retention issues, or accidental reuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script includes a hidden `--list` mode that retrieves analysis history via `show_analyze_list(open_id)` even though the skill is described only as doing one-off pet image/video temperature recommendations. Undocumented data-retrieval functionality increases the attack surface and can expose prior user analysis records or identifiers, especially because `open_id` handling is initialized implicitly and not clearly constrained by user-visible authorization checks in this file.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The implementation does not perform the manifest-declared pet drying temperature analysis; instead it exposes a generic video analysis and history-listing workflow through `skill.get_output_analysis` and `skill.get_output_analysis_list`. This mismatch is dangerous because users and downstream systems may grant the skill access to pet media and rely on safety-oriented output, while the code may process different data, call unrelated backend capabilities, or expose historical analysis data outside the declared purpose.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The CLI text and argument descriptions present the component as a general video analysis tool, contradicting the safety-sensitive pet drying recommendation use case in the manifest. In practice, this can mislead operators into using or integrating the skill for broader media processing than intended, weakening user consent boundaries and increasing the chance that unrelated or unsafe backend behavior is invoked under a trusted pet-care label.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This service exposes broad generic HTTP and CRUD capabilities that are not constrained to the skill’s stated pet drying analysis purpose. In a skill expected to process pet images and derive drying recommendations, unrestricted wrappers for arbitrary POST/PUT/GET/DELETE enlarge the attack surface and can enable unintended backend interactions, privilege abuse, or hidden data flows if other parts of the skill pass attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The add/edit/delete methods provide generic resource modification capabilities, including deletion, without any visible linkage to the declared pet drying analysis workflow. If reachable from agent logic or indirectly influenced by user input, these methods could be abused to alter or remove backend resources unrelated to the skill’s stated function, making the mismatch especially risky in a narrowly described analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: A generic user-account DAO and persistent local user database are not justified by a skill whose stated function is pet-image analysis and drying-temperature recommendation. This over-collection and broader identity-handling capability increases attack surface and creates unnecessary retention of user-linked data unrelated to the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The model stores sensitive identity and authentication-related data including username, realname, email, token, and open_token despite the skill being described as non-medical pet drying analysis. Keeping tokens in a shared local SQLite database greatly increases the risk of credential theft, cross-skill leakage, and misuse if the workspace or database is accessed by another component.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This utility provisions, resolves, and persists user identity state and tokens that are unrelated to the advertised pet-drying analysis purpose. It silently reads identity material from local workspace files and databases, then reuses or creates accounts without clear consent boundaries, which creates covert identity coupling and privacy risk across skills or agent workspaces.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The HTTP helper auto-registers or logs in users against a health-related endpoint as part of normal request handling, which materially exceeds the stated pet-image temperature-analysis purpose. Because this occurs implicitly during API use, a user invoking pet analysis could unknowingly trigger account creation, token issuance, and linkage of identifiers to an unrelated backend service.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default trigger is broad enough to activate whenever a user provides pet images or videos, even if they are only sharing media casually. Overbroad triggering can cause unintended analysis, local saving, and remote upload/query behavior without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill permits local file saving and cloud API/history queries, but the documentation does not clearly warn users about how media and associated report data are handled, stored, or linked. In a pet-image workflow this may seem low-risk, but the combination of media upload, local persistence, and account-linked history creates meaningful privacy and data-governance concerns.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill reads arbitrary local file contents and transmits them to a backend analysis service, but this file contains no consent notice, scope restriction, or path trust control around that exfiltration step. In an agent setting, this is dangerous because a user or upstream workflow could supply sensitive local paths, causing unintended disclosure of private files to a remote service.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The delete helper issues a network request for a destructive operation with no visible safeguards, user confirmation, or purpose alignment in this file. In the context of a pet drying analysis skill, an undisclosed deletion capability is suspicious because destructive backend actions are not needed for the advertised functionality and could be misused to remove data or resources silently.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code reads an identity value from data/smyx-api-key.txt and treats it as an internal identity/open-id without any user-facing disclosure or consent mechanism. Even though this is a local file read, it can silently bind requests to a preexisting identity, creating privacy, attribution, and cross-context misuse risks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code automatically performs account registration/login by posting identifiers to a remote endpoint with silent and register flags enabled, without warning the user. That is dangerous because it creates or links accounts behind the scenes and transmits identity metadata to an external service outside the narrow expectation of pet-care parameter generation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The general request helper automatically attaches identity fields and authentication tokens to outbound requests and may also enrich payloads with tenant and platform metadata, all without explicit user disclosure. In a skill whose declared function is pet image/video analysis, this broad hidden data transmission increases the chance of unnecessary tracking, token leakage through misconfiguration, or use of identities in contexts the user did not authorize.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 90% confidence
• Finding: This line transmits user identity data to an external endpoint during an automatic login/registration flow. External transmission is expected for networked skills in general, but here it is risky because the destination and purpose are unrelated to the stated pet-drying analysis function and the transmission is performed silently.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 文件要求：支持 jpg/jpeg/png/bmp/webp 图像 与 mp4/avi/mov 视频，最大 10MB，建议多角度全身画面 |
| 🧑‍⚖️ 结果性质 | 推荐结果仅供烘干设备护理参考，不提供医疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，API 服务会自动下载 |
| 🔎 使用提醒 | 推荐曲线由设备端（智能烘干箱 / 吹水机）消费，实现动态风温/风速调节，防止烫伤 |

• Confidence: 95% confidence
• Finding: The hidden-instructions indicator suggests the skill content may contain concealed or non-obvious directives, such as zero-width or otherwise obfuscated text, which can alter agent behavior without transparent review. In an agent skill, hidden instructions are dangerous because they can smuggle execution constraints, data-handling directives, or policy evasions past normal inspection.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-adaptive-pet-drying-temperature-analysis"
description: "Triggers when a user provides a full-body image/video of a pet (multi-angle preferred) for analysis; supports local uploads or network URLs to call server-side APIs for breed/body-type recognition and fur-density estimation (sparse / medium / dense), then outputs a recommended drying temperature curve (temperature in ℃ + time in minutes) for personalized care to reduce scald risk (not a medical recommendation). Application scenarios: pet drying boxes, pet grooming salons, smart pet care devices. | 当用户提供宠物全身图像/视频（多角度最佳）时，触发本技能进行品种识别与毛发密度估算（稀疏/中等/浓密），输出个性化烘干温度曲线（温度 ℃ + 时长 分钟）参数，实现个性化护理，减少烫伤风险（不提供医疗建议）。应用场景：宠物烘干箱、宠物美容店、智能宠物护理设备。"
version: "1.0.12"
license: "MIT-0"
---

• Confidence: 83% confidence
• Finding: The metadata-poisoning indicator on the manifest/description suggests the skill may be crafted to manipulate tool or agent interpretation through adversarial metadata and suspicious hidden characters. Even if the visible description appears benign, poisoned metadata can bias routing, conceal true behavior, or interfere with security controls in downstream agent systems.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2