Egg Incubation Monitoring (Turtle/Snake) | 孵化箱内龟蛋/蛇蛋发育监测

• Outcome: Review
• Latest audit: Aug 6, 2026 · 2:24 AM UTC
• Version: 1.0.9

Overview

The skill does perform egg-incubation image/video analysis, but it also silently creates or reuses account identity, sends media and identity data to cloud services, and stores reusable tokens locally.

Install only if you are comfortable with egg images/videos and report history being processed by the publisher's cloud service and linked to an automatically managed identity. Treat the local workspace data directory as sensitive because it may contain a SQLite database with reusable service tokens; avoid providing private URLs or media that should not leave your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while instructing use of shell execution, local file handling, environment/state usage, and remote network/API access. This creates a transparency and policy-enforcement gap: an orchestrator or user may treat the skill as low-privilege even though it can access local files, write outputs, and send data to external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow egg-incubation image analysis, but the described behavior includes arbitrary local file/URL submission, remote API processing, historical record retrieval, and identity/token/account handling. This mismatch is dangerous because users and calling agents may grant trust or provide files under false assumptions, enabling unintended data exfiltration, over-collection, and hidden account-linked tracking.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script resolves and uses an internal user identity for an egg-monitoring tool even though that identity is not necessary for single-file local analysis. Unnecessary identity binding increases privacy risk and can enable unintended association of analysis results or history with a user account, especially when combined with the list/history functionality.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The skill accepts arbitrary remote HTTP/HTTPS URLs for analysis even though the declared purpose is fixed-camera egg image monitoring. This creates a scope mismatch that can enable server-side fetching of attacker-controlled resources, unexpected processing of untrusted remote media, and use of the skill as a network pivot or data-ingestion path beyond the advertised functionality.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially diverges from the manifest: instead of fixed-camera egg image monitoring, it performs generic video analysis, accepts arbitrary remote URLs, and exposes history-listing behavior. This kind of scope mismatch is dangerous because users and downstream systems may grant trust, permissions, or sensitive biological media under false assumptions, enabling undisclosed data flows and unintended capability expansion.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The code and CLI repeatedly describe and implement a 'video analysis tool,' which contradicts the declared egg incubation image-monitoring use case. This inconsistency undermines informed consent and safe deployment review, increasing the chance that operators use the skill in environments or with data types that were never approved or expected.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file exposes a generic API wrapper with arbitrary CRUD and raw HTTP methods (`http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the stated egg-incubation monitoring purpose. In an agent skill context, these broad capabilities expand the attack surface and can be abused by other components or prompt-driven flows to access or modify unrelated backend resources.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The skill is described as a monitoring and analysis component, but the code includes modification-oriented helpers such as `add`, `edit`, and `delete`. Those methods create unjustified write/delete capability for a read-mostly image-analysis skill, making it possible to alter or remove remote resources if the surrounding agent can invoke them.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements a user-account DAO, including usernames, real names, email, tokens, and account lookup logic, which is unrelated to egg-incubation image analysis. This strong mismatch between declared skill purpose and actual data-handling behavior is a supply-chain red flag because hidden account-management code can quietly collect or manipulate sensitive user data under cover of an unrelated skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores user identity fields and authentication-like secrets (token, open_token) with no justification in the egg-monitoring context. In an unrelated skill, retaining such data increases the chance of credential exposure, unauthorized profiling, or covert data collection, and the context makes it more suspicious rather than less dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module provides full CRUD capabilities, including modification and deletion, for a local user database unrelated to the stated imaging/analysis function. In context, this expands the skill's attack surface and enables unauthorized tampering or persistence of sensitive records if other components invoke these generic methods without strict access control.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains broad identity management, token handling, workspace discovery, and generic authenticated HTTP request capabilities that are unrelated to the declared egg-incubation image analysis purpose. Such over-scoped functionality increases the attack surface and can let the skill access accounts, persist identities, and communicate with external services under the guise of a narrowly described vision task.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads identity material from a workspace file and silently falls back to creating or reusing local user identities, none of which is necessary for local egg-surface image inspection. This can appropriate existing workspace credentials or establish persistent identifiers without informed user action, enabling unauthorized linkage of skill activity to an account.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill performs remote login/registration, retrieves tokens, and stores them locally for later authenticated use, which is far beyond the expected behavior of an incubator image-monitoring tool. This creates a stealthy account bootstrap path and persistent authenticated channel that could be abused for data access or further API operations unrelated to the manifest.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default trigger is broad enough to auto-invoke on general egg-image or reptile-incubation requests, potentially causing unexpected file handling or remote API submission without strong user intent. In a skill that accepts local files and network URLs, overbroad triggering increases the chance of privacy-impacting or out-of-scope execution.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The history-query auto-trigger phrases are broad, and the skill mandates direct cloud API access for report retrieval. Without tighter scope checks, a vague request about reports or history could trigger account-linked remote queries and expose more historical data than the user intended.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code reads the entire local file and uploads it to an external analysis API without any in-code user warning, confirmation, or minimization. If users supply the wrong path or misunderstand the destination, sensitive local media could be exfiltrated to a remote service, which is especially relevant because incubator imagery may contain operational or environment details beyond eggs alone.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script forwards user-provided local paths or URLs to a backend analysis function without clearly telling the user that media may be sent to an external service. In this skill context, incubator imagery and related metadata may be operationally sensitive, so hidden transmission creates privacy, data governance, and compliance risk even if the backend is legitimate.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Sensitive token fields are stored directly in a local SQLite database model, and this file shows no protections such as encryption, hashing where applicable, secret-store use, or retention controls. In a skill unrelated to user auth, local credential storage is especially risky because compromise of the workspace or database file could expose reusable tokens.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When debug mode is enabled, the code activates verbose HTTPConnection and urllib3 logging, which can expose request URLs, bodies, headers, and responses to logs. Because this same file handles tokens and identity-related traffic, debug logging can leak credentials or sensitive monitoring data without a clear user-facing warning.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code silently reads a sensitive identity value from data/smyx-api-key.txt in the workspace, with no disclosure that this local identity material will be consumed by the skill. In the context of a simple egg-monitoring skill, this hidden credential use is unjustified and increases the chance of surprising or unauthorized account association.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2