Bird Recognition Tool | 鸟类识别工具

• Outcome: Review
• Latest audit: Jul 30, 2026 · 6:31 AM UTC
• Version: 1.0.15

Overview

The skill can perform cloud bird recognition, but it also silently creates or reuses user identities and stores authentication tokens locally, so it needs careful review before installation.

Install only if you are comfortable sending bird images/videos or URLs to lifeemergence.com services, allowing the skill to create or reuse a local identity, query cloud report history, and store service tokens in a workspace SQLite database. Review or constrain the bundled common API code before use in environments with sensitive local files, credentials, or strict data-retention requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable behavior such as shell invocation, local file handling, network access, and environment usage, but declares no permissions. This weakens trust boundaries for the agent platform because users and reviewers are not given an accurate picture of what the skill can access, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow bird recognition, but the described behavior extends into user identity creation/reuse, local token or user-data persistence, remote platform authentication, and historical report retrieval. This mismatch is dangerous because it can conceal collection of user-linked data and unrelated remote interactions behind an innocuous wildlife-analysis description, defeating informed consent and meaningful review.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The manifest frames the capability as image/video bird recognition, yet the skill also supports cloud-based history listing and report link retrieval. This creates a scope-expansion problem where a seemingly simple classifier becomes a data-access tool, which can expose prior user activity or report metadata that users did not expect to be queried.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The privacy section claims directly identifying plaintext personal information is not stored, but the workflow says the system may auto-reuse or auto-create a local default user identity. That inconsistency suggests undisclosed local identity persistence, which can enable silent user tracking, cross-session linkage, or exposure of identifiers if the local store is accessed.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The code accepts arbitrary http/https URLs and forwards them to the backend analysis service as `videoUrl` without allowlisting, scheme hardening beyond basic prefix checks, or user-visible restrictions. If the backend fetches the supplied URL, this can enable server-side request forgery behavior, internal network probing, or retrieval of sensitive resources depending on the downstream service's network access.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation exposes a generic video analysis/history-listing capability, while the manifest describes a bird-species recognition skill. This mismatch is dangerous because users and policy systems may grant trust, permissions, or data access based on the declared bird-recognition purpose, but the code actually sends arbitrary inputs to a broader analysis backend and can enumerate historical analyses. In a security review, capability deception materially increases supply-chain and privacy risk.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements a generic API wrapper with pagination, CRUD helpers, and arbitrary HTTP GET/POST/PUT/DELETE methods that can target caller-supplied URLs. That capability is far broader than a bird-recognition skill requires, and it creates a reusable primitive for remote data access or modification if exposed through the skill. The mismatch between declared purpose and code behavior increases suspicion because the module can be repurposed for unrelated network operations.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The add, edit, delete, http_post, http_put, and http_delete methods expose direct remote resource modification using caller-controlled URLs and arguments. In a skill advertised for bird-species recognition, these mutation capabilities are unjustified and could be abused to alter external systems, delete data, or act as a proxy for unintended API operations. Because the code provides thin wrappers with no visible validation, scoping, or safety checks, misuse risk is substantial.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: This file implements a generic shared DAO and user persistence layer that is unrelated to bird recognition, including cross-skill shared database behavior. In a skill whose stated purpose is image/video bird identification, unexplained user/account data handling expands attack surface and raises the risk of covert state sharing, privacy issues, and misuse of persisted identity data.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The User model stores identity and authentication-related fields such as username, realname, email, token, and open_token without any justification from the skill's bird-recognition purpose. Unnecessary collection and local persistence of sensitive identity and token material increases the risk of credential leakage, privacy violations, and cross-context account compromise if the local database is accessed.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer provisions remote accounts, retrieves and persists tokens, and injects identity-bearing headers into outbound API calls. That capability is unrelated to bird recognition and materially expands the skill into account bootstrapping and authenticated remote access, creating risk of undisclosed identity use, token misuse, and unauthorized service interaction.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code derives or creates a default open-id by reading workspace files and local database state, then silently reuses that identity. For a bird-recognition skill, this is unnecessary hidden identity management and can cause actions to be attributed to an implicit account without informed user consent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code enumerates agent workspace structure and creates data/skills directories, giving the skill awareness of and write access to the broader agent environment. In the context of a bird-recognition tool, this is unjustified capability expansion that increases the blast radius for data access, persistence, and lateral modification of the workspace.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The history-report trigger phrases are broad enough to match generic requests about reports or history, which can cause the skill to invoke cloud report retrieval outside a narrowly intended bird-recognition context. In an agent setting, overbroad auto-triggering can lead to unintended data access or disclosure of historical records without sufficiently specific user authorization.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The tool supports hidden API URL/key parameters and performs remote analysis, but these credentialed network behaviors are not clearly disclosed in the user-facing interface. This is dangerous because users may unknowingly provide sensitive videos or permit backend access under misleading assumptions about local-only processing, increasing the risk of unintended data transmission and secret handling.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The code resolves the current OpenID without an explicit user-facing disclosure, introducing an undisclosed identity lookup tied to analysis actions. In a skill that already appears to perform remote processing and history listing, silent identity binding increases privacy risk and can enable user activity correlation or unauthorized access to per-user history if surrounding controls are weak.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The delete method performs a potentially destructive remote action through a generic HTTP POST wrapper without any visible confirmation, scoping, or safety guardrails. In the context of a bird-recognition skill, such deletion capability is unexpected and increases the chance of unauthorized or accidental remote state changes. Even if intended for backend management, exposing destructive operations this generically is dangerous.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: When the config file does not exist, the code silently creates directories and writes a new file, while swallowing all exceptions. Silent filesystem writes reduce transparency and can alter host state unexpectedly; in agent or plugin environments this can be abused to persist data or mask misconfiguration because failures are hidden.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The save routine overwrites the target path unconditionally and suppresses all exceptions, making file modification opaque and potentially destructive. If an attacker can influence the path argument elsewhere in the application, this pattern can enable unauthorized overwrite of arbitrary writable files or conceal operational/security issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function reads data/smyx-api-key.txt to obtain an internal identity value without any visible user notice or consent flow. Silent consumption of local identity material is privacy-sensitive and can lead to undisclosed account linkage or authenticated requests under an unexpected identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This request path attaches tokens and identity values to outbound HTTP headers and request bodies, including pnaUserName and authentication headers, without clear user-facing disclosure in the code path shown. In a bird-recognition skill, such hidden identity transmission is disproportionate and risks credential leakage, account misuse, and privacy violations if endpoints or logs are compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：jpg/jpeg/png/mp4/avi/mov，最大 10MB |
| 🧑‍⚖️ 结果性质 | 识别结果仅供自然观察参考，物种保护请遵循当地法律法规 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 84% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "bird-recognition-analysis"
description: "Identifies bird species in images/videos of target areas. Supports recognition of no less than 500 common bird species, supports customized model training, suitable for ecological observation, garden bird watching and other scenarios. | 鸟类识别工具，识别目标区域图片/视频中的鸟类种类，支持不低于500种常见鸟类识别，支持定制化模型训练，适用于生态观测、庭院观鸟等场景"
version: "1.0.9"
license: "MIT-0"
---

• Confidence: 87% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2