Cat Face Recognition Skill | 猫脸识别技能

• Outcome: Review
• Latest audit: Aug 30, 2026 · 6:53 AM UTC
• Version: 1.0.9

Overview

This cat-recognition skill sends media to a cloud service and also silently manages account identity and tokens in ways users may not expect.

Review before installing. Only use this skill if you are comfortable with local cat media or submitted URLs being sent to a remote service, report history being queried from the cloud, and a local workspace identity being created or reused with tokens stored in a shared SQLite database. Avoid using it with private surveillance footage or sensitive workspace identity files unless the publisher clarifies consent, retention, token storage, and endpoint configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: This method applies filters using getattr(self.__model__, key) where key comes from a caller-supplied filters dictionary. Although SQLAlchemy prevents raw SQL injection here, untrusted keys can still trigger access to unintended ORM attributes, cause exceptions for invalid names, and enable overly broad querying of sensitive columns if higher layers pass user-controlled filter fields through unchecked.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: The count() method repeats the same caller-controlled dynamic attribute lookup pattern as list(). While not a classic SQL injection issue, it can be abused for unauthorized enumeration of records by arbitrary fields and can cause stability issues through invalid attribute access if upstream input is not constrained.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises execution paths that involve shell, file, environment, and network capabilities, but the manifest does not declare permissions or prominently disclose them. This creates a trust boundary violation: users or orchestrators may treat the skill as lower risk than it is, while it can read/write local data and send content to remote APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow cat-face recognition, but the behavior includes account creation/lookup, token acquisition, local persistence of identity metadata, and historical report access. This mismatch is dangerous because operators may authorize the skill for simple image analysis while it actually establishes persistent identity state and broad cloud interactions beyond the stated scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation behaves as a generic video-analysis/history-listing wrapper and does not enforce the manifest’s claimed cat-face-recognition scope. This mismatch is dangerous because users and higher-level agents may grant sensitive media access under the assumption of narrow cat-identification behavior, while the code can forward arbitrary paths or URLs to a broader backend analysis capability.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The CLI presents itself as a local MP4/video analysis tool, but the code simply forwards any provided local path or URL into a generic analysis function without enforcing file type, media type, or cat-specific semantics. That creates scope-expansion and trust-boundary risk, enabling unintended processing of arbitrary resources and making the actual data handling broader than the user-facing contract suggests.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This file exposes a generic API wrapper with broad CRUD and arbitrary HTTP helper methods that are not constrained to cat-face recognition workflows. In an agent skill context, such capability expansion increases attack surface and can enable unintended access to unrelated backend endpoints or data if higher-level inputs are attacker-controlled.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The add, edit, delete, and raw HTTP methods permit remote resource modification through arbitrary URLs, which exceeds the stated purpose of identifying cats from media. If any untrusted component can influence the URL or payload, the skill could be abused to alter backend state, invoke administrative APIs, or perform unauthorized actions under the skill's credentials.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: This file includes a generic user-account model and DAO behavior unrelated to the stated cat-face recognition purpose. Scope expansion into identity/account storage increases the attack surface and creates unnecessary handling of usernames, emails, tokens, and other sensitive user data within a skill that users would not expect to manage accounts.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The DAO initializes a shared SQLite database, creates tables, and performs schema migration logic automatically, which is broader than a recognition-only skill description suggests. In context, automatic writes to a shared workspace database can lead to unintended cross-skill data persistence and increase privacy risk if sensitive records are mixed across agents or skills.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs account provisioning, token retrieval, and persistent identity management that are unrelated to the stated cat-face recognition purpose. This creates hidden security-sensitive behavior: invoking the skill can implicitly create or reuse identities and obtain credentials for remote services without clear user intent, broadening the attack surface and enabling unauthorized external actions under a local or default account.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code detects workspaces and creates local data/skills directories automatically, which exceeds the narrow behavior described for cat-face recognition. In this context, automatic workspace discovery and filesystem mutation increase the blast radius of the skill and can facilitate persistence, data collection, or cross-agent interference if reused elsewhere.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill reads identity/API key material from a local workspace file to establish execution context automatically. This is dangerous because it silently binds the skill to an existing identity and can cause outbound requests or account actions to occur under credentials the user did not knowingly provide to this skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code silently posts user identifiers to an external /sys/phoneLogin endpoint with register=1 and silent=1, effectively auto-registering or logging in users. Hidden external identity enrollment is highly risky because it creates remote accounts and transmits identifiers without an explicit authentication step or clear user awareness.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill creates and updates local user records and stores tokens/open tokens in a local database as part of default operation. Persisting authentication material in general utility code without clear boundaries or storage protections increases the chance of credential theft, unintended account reuse, and privilege confusion across agents or skills.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: Although the code comments claim safe logging, the exception paths still print request context including data and a headers label, and debug mode also enables verbose HTTPConnection/urllib3 logging globally. In practice this can expose tokens, identifiers, request payloads, and response content in logs, especially during failures when secrets are often most sensitive.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad trigger phrases for history-report lookup can cause unexpected invocation of cloud report queries from ordinary user language. In this skill, that is more dangerous because report lookup is tied to internally managed identity and remote API access, so accidental activation can expose metadata or retrieve sensitive historical records without clear intent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default activation rule is ambiguous and can auto-run the skill whenever a user shares cat images or asks broadly about identification. Overbroad auto-invocation is risky here because execution may save local files and transmit data to remote APIs without a sufficiently explicit user action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill omits a clear warning that uploaded files, URLs, and report queries are sent to cloud/API services. This undermines informed consent and can lead to unintentional disclosure of private media, household surveillance footage, and account-linked report metadata.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill reads arbitrary local file contents into memory and uploads them to an external analysis service without any visible consent, warning, or narrowing to cat-face-specific data. In an agent setting, this can lead to unintended exfiltration of local sensitive files if a user or upstream workflow passes an incorrect path, especially because the code only validates extension, readability, and size.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The skill forwards user-supplied remote URLs directly to the backend analysis service without any visible notice or validation beyond scheme checking. This creates privacy and trust concerns because the backend may fetch third-party content, log the URL, or access internal resources depending on how the remote service is implemented.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The hidden --api-key parameter suppresses visibility of credential handling from normal help output, while the tool may perform outbound analysis operations. This is dangerous because operators may unknowingly pass sensitive credentials into a skill that transmits data externally, weakening informed consent, auditability, and safe secrets handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code consumes sensitive identity material from a workspace file without any visible user-facing notice or consent mechanism in this file. Even if intended for convenience, this is a privacy and transparency issue because users may not realize that local identity state is being harvested and reused by the skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This request wrapper transmits usernames, open IDs, tokens, and related user context to remote services, but the file contains no user disclosure or consent controls around those transmissions. In a cat-face recognition skill, such hidden identity-related network activity is especially suspicious because it is not clearly necessary for local image comparison functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 90% confidence
• Finding: The POST to the external login/registration endpoint transmits identity data off-host, which is a real external data transmission event. In context, this is more dangerous because the skill is presented as cat-face recognition, not account provisioning, so users would not reasonably expect their identifiers to be sent to a remote auth service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2