Environmental Anomaly Trigger | 畜禽舍环境异常联动

• Outcome: Review
• Latest audit: Oct 30, 2026 · 8:30 AM UTC
• Version: 1.0.14

Overview

This livestock-analysis skill needs review because it automatically registers accounts and stores credentials, while an option promising to skip analysis can still upload footage.

Before installing, review Life Emergence's account enrollment, footage handling, and credential retention. Use a dedicated workspace and provider identity. Request a fix for --export-env-only before relying on it to prevent uploads, and independently approve any suggested payment-skill installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk manages a sys_user database containing usernames, real names, email addresses, demographic fields, and tokens. It provides user-specific queries and schema migrations but contains no video processing, environmental-sensor integration, or livestock stress detection. Database persistence could support the declared application, but the visible implementation specifically concerns user and token management without an evident connection to that purpose. This assessment is limited to the supplied chunk; it does not establish what other skill files do or imply token exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code does not implement the declared livestock stress-detection purpose. It also does not actually execute the commented-out agent command. Imported base classes and services could contain additional behavior, but their implementations are not supplied, so they cannot establish that this chunk performs the advertised analysis. No undeclared external execution or data access is demonstrated by the visible code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk contains no video processing, environmental sensor integration, or livestock stress detection. Generic utilities alone would be reasonable supporting implementation details, but the account provisioning, persistent identity management, and credential-bearing network behavior introduce substantial capabilities not represented by the description. The HTTP wrapper also attaches configured authentication headers to caller-supplied absolute URLs without a visible destination restriction. These actions occur when the relevant methods are called; the chunk does not establish that they run automatically or that credentials are maliciously exfiltrated. Other files could implement the declared analysis, but that cannot be verified from this chunk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-environmental-anomaly-analysis"
description: "Combines livestock behavior in continuous barn videos with environmental sensor data (temperature, humidity, ammonia, etc.) to identify group stress responses caused by abnormal in-barn conditions. | 结合畜禽行为与环境传感器，识别温湿度异常时的群体应激反应。"
version: "1.0.18"
license: "MIT-0"
---

# 🌡️ Livestock Barn Environmental Anomaly Correlation | 畜禽舍环境异常联动

> 结合畜禽行为与环境传感器，识别温湿度异常时的群体应激反应。
>
> **环境应激联动预警中枢** · 畜禽舍连续视频智能分析 �

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The automatic trigger includes the generic phrase “历史报告” (“historical reports”) without requiring livestock-environment context.

Medium

• Category: Trigger Abuse
• Confidence: 95% confidence

Finding

The example makes the generic phrase '历史报告' an automatic trigger, while the workflow mandates a cloud history request when triggered. This can turn an unrelated report request into an unintended authenticated lookup and disclosure of livestock-report metadata in the current conversation.

Content

No source excerpt is available for this finding.

The documented --export-env-only mode still executes analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser advertises a mode that does not execute analysis, but the parsed flag is never checked. With an input supplied, a caller relying on that guarantee can unexpectedly initiate analysis and upload barn footage; identity initialization also occurs before any such safeguard.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are passed to an analysis API without disclosure that the file will be uploaded.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The code reads the entire local file and passes its contents to the analysis API through the files argument. There is no confirmation, user-facing notice, or comment explaining the transmission; the comment only describes reading the file, and requesting analysis does not necessarily imply uploading a local video.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to execute analysis, but the code ignores it and proceeds with analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises no analysis but is ignored after parsing. Supplying it alongside an input still initializes identity and invokes the remote analysis workflow, potentially transmitting footage contrary to the caller's explicit expectation.

Content

No source excerpt is available for this finding.

The service provides caller-directed remote mutation capabilities unrelated to environmental anomaly analysis.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

At L077-L081 and L091-L095, the service forwards caller-supplied URLs and arguments to HTTP PUT and DELETE operations. Retrieving barn videos and sensor readings is consistent with the manifest, but general-purpose remote modification and deletion capabilities are not justified by its stated analytical purpose.

Content

No source excerpt is available for this finding.

The skill includes user-profile and credential database management unrelated to environmental anomaly analysis.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

L448-L465 define persistent user records containing personal information and token/open_token fields, and L470-L473 expose these records through a DAO inheriting read, write, update, and delete operations. DAO initialization also creates tables and modifies the sys_user schema (L180-L215). Managing user identities and credentials is not justified by the manifest's stated purpose of correlating livestock behavior with environmental sensor anomalies.

Content

No source excerpt is available for this finding.

ai_chat documents an OpenClaw agent invocation, but the implementation never invokes the agent or produces an analysis result.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L26 explicitly claims to call the OpenClaw agent through subprocess and promises an analysis result or session ID at L33-L34. However, the command and subprocess invocation are commented out at L48-L66; the empty dictionary at L68 instead causes the attribute access at L70 to fail, after which the exception handler returns no result. This contradicts the documented analysis delegation rather than merely omitting an implementation detail.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

Opening a path in 'w' mode immediately truncates an existing file, even before the caller writes anything. This method has no docstring, comment, confirmation, or action-specific log explaining that behavior; exception tracing does not disclose successful truncation.

Content

No source excerpt is available for this finding.

Analysis requests can silently provision remote user accounts and persist authentication data.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

A normal request can trigger silent remote login or account registration and then persist returned authentication tokens and profile information. There is no explicit enrollment or consent gate in this path, creating identity-disclosure and credential-retention side effects beyond the stated environmental-analysis task.

Content

No source excerpt is available for this finding.

Automatic remote login or registration transmits the current identity without disclosure.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The login helper sends the current identity as both openId and mobile while requesting silent registration. That identity can be a configured username or API-secret-derived value, so an ordinary analysis request can disclose identifying or sensitive data without a separate authorization step.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The POST sends identity and source metadata to the configured remote authentication service as part of automatic login or registration. External requests are not inherently unsafe, but this request lacks an explicit enrollment gate and can send an API-secret-derived identity, making this a concrete disclosure risk rather than merely routine analysis traffic.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

A payment failure substitutes instructions to install another skill and recharge an account for the analysis result.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

An HTTP 402 response returns imperative skill-installation and payment instructions through the same interface that normally returns analysis data. It also appends the raw remote response, allowing externally controlled text to reach an agent-facing result and potentially redirect the workflow if treated as instructions.

Content

No source excerpt is available for this finding.

Loading configuration silently creates directories and writes a configuration file when the path does not exist.

Low

• Category: Output Handling
• Confidence: 95% confidence

Finding

YamlUtil.load performs filesystem writes without a confirmation, log message, or explanatory comment or docstring. Because BaseEnum.init_subclass calls this loader during class definition (L053 and L058), importing the module can create configuration files without disclosing this side effect.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default