Security audit

Bird Recognition Tool | 鸟类识别工具

Security checks for vulnerabilities and agentic risk

Overview

This bird-recognition skill uploads media to a cloud service and manages user identity, but it defaults to insecure plaintext development endpoints and stores service tokens locally in plaintext.

Install only after reviewing the publisher and endpoint configuration. This skill sends user media or media URLs to a remote service, creates or reuses an internal user identity, retrieves cloud report history, and persists service tokens locally. The current artifact should be corrected to use HTTPS-only production endpoints, remove private dev defaults, protect or avoid stored tokens, and make history and identity behavior explicit before normal use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/config-dev.yaml:1
Finding: Authentication Credentials and User Media Are Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:3-15`, `skills/smyx_common/scripts/config-dev.yaml:1-6`, `skills/smyx_common/scripts/util.py:610-646` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```yaml # skills/smyx_common/scripts/config.yaml ApiEnum: api-key: null api-secret-key: null base-url-health: https://lifeemergence.com/jeecg-boot-xzgz base-url-open-api: https://open.lifeemergence.com/smyx-open-api base-url-open-h5: http://livemonitor.lifeemergence.com database-url: null ConstantEnum: app--id: x1a3s4nwy1s2r4se current--tentant-code: XIAN_ZHAO_GAN_ZHI default--skill-platform-name: ARK_CLAW feishu-app--id: cli_a93d769369badcb1 feishu-app--secret: null is-debug: false env: dev ``` ```yaml # skills/smyx_common/scripts/config-dev.yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` ```python # skills/smyx_common/scripts/util.py headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN) data = data or {} params = params or {} options = options or {} ConstantEnum.CURRENT__TENTANT_CODE and data.setdefault( 'tenantCode', ConstantEnum.CURRENT__TENTANT_CODE ) ConstantEnum.DEFAULT__SKILL_HUB_NAME and data.setdefault( 'skillHubName', ConstantEnum.DEFAULT__SKILL_HUB_NAME ) ConstantEnum.DEFAULT__SKILL_PLATFORM_NAME and data.setdefault( 'skillPlatform', ConstantEnum.DEFAULT__SKILL_PLATFORM_NAME ) if current__user_name: data.setdefault('pnaUserName', current__user_name) response = requests.request( method, url, *args, json=data, params=params, headers=headers, timeout=int(timeout), **argss ) ``` ### Technical ...[truncated 2435 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the distributed default environment from `dev` to a production configuration using HTTPS exclusively. 2. Remove private development endpoints from production Skill packages. 3. Reject API base URLs that do not use `https://`; do not merely warn and continue. 4. Apply an explicit allowlist of trusted API hosts before attaching authentication headers. 5. Keep TLS certificate verification enabled and use a controlled CA bundle if private infrastructure requires it. 6. Separate development settings from deployable artifacts and load them only through an explicit, local developer opt-in. 7. Rotate all tokens that may have been sent through the plaintext endpoints. 8. Update the privacy documentation so that it accurately reflects runtime behavior. 9. Add automated tests that fail when an active endpoint uses HTTP or when credentials would be attached to an unapproved host. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:580
Finding: Service Authentication Tokens Are Persisted in Plaintext SQLite Storage<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:580-606`, `skills/smyx_common/scripts/dao.py:169-180`, `skills/smyx_common/scripts/dao.py:452-462` **Vulnerability Type**: Insecure local credential storage **Risk Level**: Medium ### Vulnerable Code ```python # skills/smyx_common/scripts/util.py if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` ```python # skills/smyx_common/scripts/dao.py if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) ``` ```python # skills/smyx_common/scripts/dao.py class User(Base, BaseModelMixin): __tablename__ = "sys_user" id = Column(String(32), primary_key=True, index=True) source_id = Column(String(32), comment="source identifier") username = Column(String(100), unique=True, index=True, nullab ...[truncated 2415 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid persisting bearer tokens where possible; use short-lived tokens and refresh them through a protected authentication flow. 2. Store persistent secrets in the operating system's credential manager rather than a general SQLite database. 3. If database storage is unavoidable, encrypt token values with a key held outside the database. 4. Create the workspace data directory and database with owner-only permissions, such as mode `0700` for the directory and `0600` for the file on POSIX systems. 5. Prevent tokens from being included in backups, diagnostics, exports, or report output. 6. Define token expiration and automatic revocation behavior. 7. Rotate existing tokens after deploying the corrected storage mechanism. 8. Store only the minimum profile fields required to associate reports with the local user. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:38
Finding: Low-Level HTTP Debugging Can Disclose Authentication Headers and Request Content<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:38-50`, `skills/smyx_common/scripts/config.py:143-144`, `skills/smyx_common/scripts/config-dev.yaml:5-6` **Vulnerability Type**: Sensitive information exposure through debug logging **Risk Level**: Medium ### Vulnerable Code ```python # skills/smyx_common/scripts/util.py if ConstantEnum.is_debug(): import http.client http.client.HTTPConnection.debuglevel = 1 import logging logging.basicConfig() logging.getLogger().setLevel(logging.DEBUG) requests_log = logging.getLogger("urllib3") requests_log.setLevel(logging.DEBUG) requests_log.propagate = True ``` ```python # skills/smyx_common/scripts/config.py @staticmethod def is_debug(): return platform.system() == 'Windows' or platform.system() != 'Linux' and ConstantEnum.IS_DEBUG ``` ```yaml # skills/smyx_common/scripts/config-dev.yaml ConstantEnum: is-debug: true ``` ### Technical Analysis The Skill enables `http.client.HTTPConnection.debuglevel = 1` when debug mode is active. Low-level HTTP debugging can emit raw request lines, headers, and request content directly to standard output. Application-level comments that avoid printing the `headers` dictionary do not protect against output generated below that layer. The `is_debug()` expression returns `True` on every Windows system regardless of the configured `IS_DEBUG` value. The distributed configuration also selects the development environment, where `is-debug` is enabled. Consequently, sensitive debugging can be active under ordinary deployment conditions rather than only during deliberate diagnostics. Because authenticated requests contain `X-Access-Token`, `X-Api-Key`, and `Authorization`, debug output may disclose reusable secrets to terminal logs, CI logs, process supervisors, or Agent transcripts. ### Attack Path 1. The Skill runs on Windows, or it loads the active development configuration. 2. `ConstantEnum.is_debug()` ev ...[truncated 834 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable `http.client.HTTPConnection.debuglevel` in distributed builds. 2. Require a separate, explicit runtime opt-in for transport-level debugging. 3. Correct `is_debug()` so that it respects the configured flag on every operating system: ```python @staticmethod def is_debug(): return bool(ConstantEnum.IS_DEBUG) ``` 4. Set the production and default configurations to `is-debug: false`. 5. Add a logging filter that removes `Authorization`, `X-Access-Token`, `X-Api-Key`, cookies, and token-like response fields. 6. Do not log request bodies when they may contain media, identifiers, or personal data. 7. Review existing logs for exposed secrets and rotate any credentials that may have been recorded. 8. Add tests confirming that authenticated headers never appear in standard output or application logs. ]]>

T08 · Insecure Dependencies

Warning

Location: skills/smyx_analysis/requirements.txt:1
Finding: Incorrect YAML Dependency Name Creates Dependency-Confusion and Installation Risk<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_analysis/requirements.txt:1-3` **Vulnerability Type**: Incorrect or potentially unsafe dependency declaration **Risk Level**: Medium ### Vulnerable Code ```text pydash==8.0.6 SQLAlchemy==2.0.46 yaml==6.0.3 ``` ### Technical Analysis The code imports the module as `yaml`, but the established Python distribution that provides this module is `PyYAML`. The common package manifest in the same project correctly declares `PyYAML==6.0.3`, while the analysis package instead declares `yaml==6.0.3`. Package import names and distribution names are not interchangeable. Declaring an incorrect distribution can cause installation failure or, when an untrusted or private package index contains a matching name, install an unintended package. This is a dependency-confusion or typosquatting exposure rather than evidence that a malicious package is currently bundled in the repository. ### Attack Path 1. An installer processes `skills/smyx_analysis/requirements.txt`. 2. The package manager requests the distribution named `yaml` rather than `PyYAML`. 3. A configured package index or mirror supplies a package under that incorrect name, or dependency resolution fails. 4. If an attacker controls or has published the resolved package on an allowed index, its installation hooks or imported code execute with the privileges of the installation process. 5. The attacker may then access files, environment variables, or network resources available to that process. ### Impact Assessment If an unintended package is resolved and installed, its code could execute with the privileges of the user or service performing installation. That scope may include: - Reading files accessible to the Agent runtime. - Reading environment variables and locally stored credentials. - Making arbitrary network connections. - Modifying the Skill environment. The actual outcome depends on package-index configuration. On an index where no match ...[truncated 109 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the incorrect declaration with: ```text PyYAML==6.0.3 ``` 2. Maintain one authoritative dependency manifest or lock file to prevent inconsistent package names across subpackages. 3. Pin dependencies to reviewed versions and include cryptographic hashes using a hash-locked requirements file. 4. Restrict installation to trusted package indexes and disable unintended fallback indexes. 5. Run dependency installation in a least-privileged, isolated environment. 6. Add automated dependency validation that verifies distribution names and confirms that imports originate from the expected packages. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated external requests, automatic account initialization, local persistence, and environment/context management represent significant hidden complexity for a purported bird-recognition utility. In context, this makes the skill more dangerous because wildlife media analysis does not inherently require identity lifecycle management or persistent local state.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: --- name: "bird-recognition-analysis" description: "Identifies bird species in images/videos of target areas. Supports recognition of no less than 500 common bird species, supports customized model training, suitable for ecological observation, garden bird watching and other scenarios. | 鸟类识别工具，识别目标区域图片/视频中的鸟类种类，支持不低于500种常见鸟类识别，支持定制化模型训练，适用于生态观测、庭院观鸟等场景" version: "1.0.15" license: "MIT-0" --- # 🐦 Bird Recognition Tool | 鸟类识别工具 > **智能健康/识别分析中枢** · 图片/视频智能分析
Confidence: 80% confidence
Finding: The YARA hit for metadata poisoning indicators, combined with the strong description-behavior mismatch and unusual health/analysis branding in a bird-recognition manifest, suggests the metadata may be crafted to shape trust or routing decisions deceptively. Even if not overtly malicious, deceptive metadata in an agent ecosystem is dangerous because tools are often selected and authorized based on manifest text.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The privacy section says raw video is deleted immediately, but the documented cloud history/report workflow implies ongoing server-side retention of analysis artifacts. Contradictory privacy claims are security-relevant because they prevent informed consent and can hide longer-than-expected storage of user data or derived reports.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Automatic creation or reuse of internal user identities is unrelated to basic bird recognition and creates a hidden identity-management subsystem. This is dangerous because it can silently link analyses across sessions, retain personal associations, and widen the consequences of compromise or misuse.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The implementation is a generic analysis/reporting client and does not perform bird-species recognition as advertised in the skill metadata. This capability mismatch is security-relevant because users may upload sensitive image/video data under false expectations, and the code forwards content to a broader analysis service with polling/report export behavior unrelated to the declared purpose.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The implementation performs generic video analysis and history retrieval, while the manifest advertises bird-species recognition. This mismatch is dangerous because users may grant access to media or rely on outputs under false assumptions about the skill’s purpose, enabling covert collection or processing of unrelated video data.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements a generic API wrapper with CRUD-style methods and arbitrary HTTP verb helpers that can send requests to caller-supplied URLs. That capability materially exceeds a bird-recognition skill’s stated purpose and can be repurposed as a general network client for unintended data access, command-and-control style traffic, or exfiltration through external services. The skill context makes this more dangerous because nothing in the manifest justifies unrestricted outbound request functionality.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The direct exposure of http_post, http_put, http_get, and http_delete methods provides arbitrary outbound network request capability with no visible host restriction, authentication boundary, or purpose limitation. In an agent skill, this can enable SSRF-like behavior, data exfiltration, or abuse of the runtime as a generic proxy, which is especially suspicious when the advertised function is bird identification rather than general API access.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code reads identity-like values from workspace files and auto-generates default local identities, then stores them for reuse. In a bird-recognition skill this is especially suspicious because it enables silent identity bootstrapping and persistence, which can be abused for covert account creation, tracking, or unauthorized API use.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This utility code provisions user accounts, retrieves or creates tokens, and persists authentication state even though the advertised skill is bird recognition. That mismatch materially increases risk because the skill can create identities and obtain credentials for remote services without a clear functional need, expanding both data exposure and unauthorized network access surfaces.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The manifest documents capabilities that imply shell, network, file read/write, and environment access, but it does not declare any explicit tool scope or permissions boundaries. This weakens reviewability and increases the chance that a broadly privileged skill is installed or executed without operators understanding its actual access level.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill includes cloud-based historical report lookup that is not clearly necessary for the declared recognition purpose and expands data exposure beyond one-time analysis. History features can reveal prior uploads, metadata, and report links, making misuse or unauthorized correlation more damaging than a simple stateless classifier.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Broad trigger phrases for history-report retrieval can cause the skill to invoke cloud listing behavior on ambiguous user requests. In agent settings, this increases the risk of accidental disclosure of report inventories or metadata when the user intended a more general question.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2