Environmental Anomaly Trigger | 畜禽舍环境异常联动

• Outcome: Review
• Latest audit: Sep 7, 2026 · 2:15 AM UTC
• Version: 1.0.10

Overview

The skill performs the advertised barn analysis, but it also silently handles identity, uploads data to remote services, and stores or transmits authentication material in ways that need review.

Review this skill before installing. It sends barn media or URLs to a remote analysis service, silently creates or reuses an internal identity, can query account-linked report history, and stores remote tokens locally. Do not use it with sensitive footage or real credentials unless the publisher switches to HTTPS production endpoints by default, documents the identity/account flow, avoids plaintext token storage, and fixes the dependency declaration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/util.py:548
• Finding: Authentication Credentials, Internal Identity, and Uploaded Media Are Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:15`, `skills/smyx_common/scripts/config-dev.yaml:2-4`, `skills/smyx_common/scripts/util.py:548-561, 572-646`, `skills/smyx_analysis/scripts/skill.py:113-129` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code The default configuration activates the development environment: ```yaml env: dev ``` That environment replaces the HTTPS production endpoints with plaintext HTTP endpoints: ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ``` The request utility transmits the internal identity to the plaintext health endpoint: ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") except Exception as _e: CommonUtil.trace_exception_stack(_e) return {} ``` It then adds authentication material to subsequent requests without requiring HTTPS or restricting the destination hostname: ```python if not url.startswith("https://") and not url.startswith("http://"): url = cls.BASE_URL + url headers['App-Id'] = ConstantEnum.APP__ID headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN) data = data or {} params = params or {} options = opt ...[truncated 3516 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `env: dev` from the shipped default configuration and use HTTPS production endpoints by default. 2. Reject all plaintext HTTP endpoints outside an explicitly enabled, isolated test environment. 3. Validate API destinations against a strict allowlist before adding authentication headers. 4. Only attach authentication headers after confirming the URL uses HTTPS and belongs to an approved hostname. 5. Configure private development services with TLS rather than relying on plaintext LAN transport. 6. Add an explicit timeout to the `/sys/phoneLogin` request. 7. Continue using certificate verification and do not introduce `verify=False`. 8. Avoid duplicating an internal identifier into a field named `mobile` unless the server contract strictly requires it. 9. Clearly disclose remote media upload and obtain user consent before transferring local files. 10. Rotate all tokens that may previously have traversed the plaintext development endpoints. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/dao.py:460
• Finding: Bearer Tokens Are Persisted in an Unencrypted Shared SQLite Database<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:586-605`, `skills/smyx_common/scripts/dao.py:175-180, 460-461` **Vulnerability Type**: Insecure storage of authentication credentials **Risk Level**: Medium ### Vulnerable Code Tokens returned by the remote authentication service are copied into a local user model and saved: ```python if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` The storage backend is a normal SQLite database: ```python if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) ``` The token fields are ordinary plaintext string columns: ```python token = Column(String(500), comment="token") open_token = Column(String(1000), comment="开放token") ``` ### Technical Analysis The Skill stores remote access and authorization tokens directly in an unencrypted SQLite database under the Agent workspace data directory. No field encryption, operating-system credential store, restrictive permission enforcement, or token-at-rest lifecycle protection is implemented. SQLite does not encrypt database fields by default. Consequently, any local account, process, backup system, or other Skill ...[truncated 1461 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store tokens in an operating-system-backed credential manager rather than SQLite. 2. If database persistence is unavoidable, encrypt token fields with a key stored separately from the database. 3. Create the database with owner-only permissions and explicitly enforce mode `0600` on POSIX systems. 4. Restrict the parent data directory to the Agent owner. 5. Do not share credential storage between unrelated Skills. 6. Use short-lived, narrowly scoped tokens and refresh them only when necessary. 7. Delete expired or revoked tokens immediately. 8. Avoid placing credential-bearing databases in backups unless those backups are encrypted and access-controlled. 9. Add a migration that removes or encrypts existing plaintext token records. 10. Rotate tokens already stored by previous versions. ]]>

T08 · Insecure Dependencies

Warning

• Location: skills/smyx_analysis/requirements.txt:1
• Finding: Incorrect Python Distribution Name Creates Dependency-Confusion and Installation Risk<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_analysis/requirements.txt:1-3` **Vulnerability Type**: Incorrect or potentially typo-squatted dependency name **Risk Level**: Medium ### Vulnerable Code The analysis dependency manifest declares: ```text pydash==8.0.6 SQLAlchemy==2.0.46 yaml==6.0.3 ``` The common component correctly uses the actual distribution name: ```text pydash==8.0.6 SQLAlchemy==2.0.46 PyYAML==6.0.3 ``` The source code imports the module as follows: ```python import yaml ``` ### Technical Analysis The Python import name is `yaml`, but the expected package distribution is `PyYAML`. Declaring `yaml==6.0.3` confuses the importable module name with the package distribution name. Depending on the configured package index, this can cause installation failure or resolution of an unintended similarly named package. In an environment that uses an untrusted or attacker-controlled package index, an attacker could publish or serve a package matching the requested name and version. Python package installation can execute build hooks or other installation-time code in the installer's security context. The exact exploitability depends on index configuration and whether a matching distribution is available. The manifest nevertheless introduces an avoidable supply-chain resolution risk. ### Attack Path 1. An operator or automation process installs `skills/smyx_analysis/requirements.txt`. 2. The package manager requests the distribution `yaml==6.0.3`. 3. The resolver searches its configured public or private package indexes. 4. An attacker-controlled or unintended distribution matching that name and version is selected. 5. The package's build or installation logic executes with the privileges of the installer. 6. The malicious package can access files, environment variables, network resources, and credentials available to that installation process. ### Impact Assessment If an unintended malicious package is resolved, it can ex ...[truncated 438 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `yaml==6.0.3` with: ```text PyYAML==6.0.3 ``` 2. Consolidate duplicated dependency manifests so all components use the same canonical package names and versions. 3. Generate a lockfile containing cryptographic hashes for all resolved distributions. 4. Install only from trusted, explicitly configured package indexes. 5. Use `--require-hashes` or an equivalent verified-installation mechanism in deployment automation. 6. Test dependency installation in an isolated environment as part of continuous integration. 7. Review transitive dependencies and retain exact version controls where operationally appropriate. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 82% confidence
• Finding: This method applies filters by dynamically resolving model attributes from caller-supplied keys. While SQLAlchemy still parameterizes values, unvalidated attribute selection can let untrusted callers query on unintended columns, trigger exceptions for invalid names, or bypass higher-level business restrictions if this generic DAO is exposed through API inputs.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: The count() method repeats the same dynamic attribute resolution pattern for caller-controlled filter keys. Even without classic SQL injection, this can expose metadata about restricted fields, enable unauthorized record counting on sensitive attributes, or cause controllable failures if invalid attributes are passed through application layers.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises and instructs use of capabilities including shell execution, network access, local file reads/writes, and environment-dependent behavior, but does not declare permissions or present clear capability boundaries. This weakens reviewability and informed consent, making it easier for the skill to perform sensitive operations such as local persistence, remote API calls, and script execution without explicit governance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented purpose is narrowly framed as livestock environmental anomaly analysis, but the observed behavior expands into identity creation/reuse, local SQLite persistence, token/account handling against external services, and historical report retrieval from a backend. This mismatch is dangerous because operators may trust the skill with animal-video analysis while it silently performs broader account-linked and persistent data operations that are not central to the stated function.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill exposes a history-listing function tied to a user identity that is not part of the stated environmental anomaly-analysis purpose. Even though it is triggered via a CLI flag rather than being fully hidden code execution, it expands the data-access surface and may disclose prior analysis records for the current internal user without clear authorization or user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code initializes and uses an internal user identity through OpenIdUtil.resolve_current_open_id even when the advertised function is only media/sensor anomaly analysis. This creates unnecessary identity coupling and enables access to user-scoped data paths such as report history, increasing privacy and authorization risk if the identity is resolved implicitly or without transparent user control.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This service exposes broad generic wrappers for arbitrary HTTP GET/POST/PUT/DELETE plus CRUD-style helpers that are not constrained to the skill’s stated anomaly-analysis purpose. In an agent setting, this unnecessarily expands capability from analysis into general remote interaction, enabling misuse for unauthorized data manipulation or access if higher-level callers can influence URLs or payloads.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The add, edit, and delete methods provide direct remote record creation, modification, and deletion capabilities despite the skill being described as a read/analysis workflow. This mismatch increases risk because an agent or downstream component could use the skill to alter external systems rather than only retrieve or analyze barn/environment data.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This file includes a persistent user-account model and DAO, including usernames, real names, emails, birthdays, tokens, and lookup/update helpers, which is unrelated to environmental anomaly analysis. In a skill whose stated purpose is livestock/environment analytics, hidden identity and token storage materially expands the data-handling surface and could facilitate unauthorized tracking, credential persistence, or later misuse.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The DAO initializes local SQLite storage, creates tables, and performs schema migration logic despite the skill being described as analytics-focused. Unnecessary persistence and automatic schema mutation increase attack surface, create unreviewed statefulness, and may retain sensitive operational or user-linked data beyond what the skill's purpose justifies.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements a generic `ai_chat`/agent-invocation capability that is unrelated to the stated purpose of environmental anomaly analysis. Hidden or unnecessary general-purpose agent hooks expand the skill’s effective privileges and create a pathway for prompt-driven misuse, data exfiltration, or unauthorized actions if later wired to a real backend.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring states that the function invokes an external agent via subprocess, but the actual subprocess execution is commented out. This deceptive mismatch is dangerous because reviewers and downstream components may assume real agent execution semantics, trust boundaries, logging, timeout handling, or security controls that do not actually exist.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer implements automatic remote login/account provisioning and token bootstrap behavior that is unrelated to environmental anomaly analysis. This expands the skill's capabilities into identity handling and backend access without clear user consent, creating a covert data-flow and authentication surface that could be abused to enroll users, mint tokens, or route requests under unexpected identities.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code generates or reuses persistent local identities, reads implicit workspace identity sources, and stores user records/tokens for future use. For a livestock/environment analytics skill, this is unnecessary privilege expansion and creates silent identity persistence that can enable impersonation, tracking, or unauthorized reuse of credentials across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code inspects agent workspace layout, environment variables, and creates shared data/skills directories, behavior that is broader than needed for anomaly detection. In an agent environment, this increases the skill's reach into workspace structure and can facilitate persistence, cross-skill interference, or access to files outside the narrow analytic task.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The history-report trigger phrases are broad enough that ordinary user language such as asking about 'history reports' could automatically invoke a cloud query path. In this context, that can cause unintended access to account-linked historical data and unnecessary remote calls without a strong confirmation boundary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that uploaded attachments and sensor/video/image files are automatically saved as local files, but it does not prominently warn users about retention, location, duration, or cleanup. Automatic persistence of potentially sensitive operational footage and sensor data increases privacy and data-handling risk, especially when combined with identity linkage and report history features.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code uploads local file contents or submits remote video URLs to an external analysis service without any user-facing disclosure, confirmation, or visible consent mechanism in this component. In a livestock/barn monitoring context, videos and URLs may contain sensitive operational data, making silent exfiltration to a remote service a meaningful privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill reads a workspace credential-like file (data/smyx-api-key.txt) implicitly and uses its contents as an identity source without disclosure. Silent consumption of ambient credentials is dangerous because it bypasses user intent, can surprise operators, and may cause requests to be made under a sensitive or unintended account.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: Automatically creating a workspace skills directory broadens the skill's footprint and can support later persistence or modification of the agent environment, even if this snippet alone does not write executable content. In context with the workspace-discovery logic, this behavior is suspiciously beyond the stated analytics scope.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code automatically sends identity-linked fields such as openId and mobile to a remote login endpoint, with registration enabled, without clear user disclosure. This is a privacy and security issue because it transmits user-identifying data and can trigger account creation or backend linkage unexpectedly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The utility persists generated identity information and associated user data into a local database without an explicit warning or consent flow. Silent persistence increases the blast radius of compromise, enables tracking across runs, and may retain credentials or identifiers longer than users expect.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This outbound request transmits identity data to an external endpoint as part of a hidden login/registration flow. In the context of a barn anomaly analysis skill, such transmission is unrelated to the stated purpose and therefore more dangerous, because users would not reasonably expect identity enrollment or backend account operations from this functionality.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB`；可选 csv/json 传感器数据 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供环境-行为异常联动预警参考，本技能不提供设备操作指令或环境调控建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 72% confidence
• Finding: The hidden-instructions indicator suggests the manifest may contain non-obvious control text or invisible characters influencing agent behavior beyond what a reviewer can readily see. In a skill that already drives shell commands, network access, and backend-linked report retrieval, concealed instruction content raises the risk of prompt/tooling manipulation and reviewer evasion.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-environmental-anomaly-analysis"
description: "Combines livestock behavior in continuous barn videos with environmental sensor data (temperature, humidity, ammonia, etc.) to identify group stress responses caused by abnormal in-barn conditions. | 结合畜禽行为与环境传感器，识别温湿度异常时的群体应激反应。"
version: "1.0.10"
license: "MIT-0"
---

• Confidence: 83% confidence
• Finding: Metadata poisoning indicators in a skill manifest are a serious concern because manifest fields are often trusted by agents and reviewers as descriptive rather than adversarial. If metadata contains manipulative or hidden control content, it can bias tool selection, suppress scrutiny, or redirect execution behavior while appearing innocuous.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2