Security audit
Security checks for vulnerabilities and agentic risk
The skill has a plausible livestock video-analysis purpose, but it uses cloud upload, automatic identity creation, plaintext default endpoints, and persistent token storage in ways that require Review before installation.
Install only after confirming this skill will run against trusted HTTPS production endpoints, not the bundled dev HTTP endpoints. Be aware that local camera media may be uploaded to a cloud service, report history is tied to an automatically managed identity, and reusable service tokens may be stored in the workspace data directory unless the publisher changes the implementation.
skills/smyx_common/scripts/config-dev.yaml:1Sensitive media, identity data, and authentication credentials are transmitted over plaintext HTTP
skills/smyx_common/scripts/dao.py:448Authentication tokens are persisted unencrypted in a shared SQLite database
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
Outbound API requests, token handling, identity creation/retrieval, and workspace data access are all sensitive operations that materially change the risk profile of the skill. In a skill that processes user-supplied media and silently associates it with internal identities, undeclared infrastructure of this kind can lead to privacy violations, excessive data access, and difficult-to-detect misuse.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-feed-drink-behavior-monitor-analysis"
description: "Analyzes fixed-camera videos of feeders and waterers to quantify livestock feeding duration, feeding bouts and drinking frequency, comparing them against individual baselines to raise behavior anomaly alerts. | 通过视频统计畜禽采食时长、饮水频次，异常时预警。"
version: "1.0.9"
license: "MIT-0"
---
# 🐖 Livestock Feeding & Drinking Behavior Monitor | 畜禽采食/饮水行为监测
> 通过视频统计畜禽采食时长、饮水频次，异常时预警。
>
> **精准饲喂行为中枢** · 食槽/饮水器视频智能分析 · 采食时长与频次统�
The file implements a generic user-account DAO with lookup and update operations for usernames, real names, and tokens, which is materially unrelated to a livestock fixed-camera behavior-monitoring skill. Capability expansion beyond the declared purpose increases the attack surface and enables hidden collection or management of user identity data without clear necessity or user expectation.
The User model stores identity and authentication-adjacent data including username, realname, email, token, and open_token despite the skill being described as livestock video behavior analysis. In this context, collecting and persisting such data is unnecessary, privacy-invasive, and could expose credentials or long-lived tokens if the local SQLite database is accessed by another component or attacker.
This utility file contains identity resolution, token persistence, user lookup/creation, and authenticated HTTP request handling that are far broader than the declared livestock video-analysis purpose. That mismatch is dangerous because the skill can silently act as an account-provisioning and API client component, enabling undisclosed data transmission and remote-side effects unrelated to user expectations.
The code can silently register or log in a user against a remote service using derived local identifiers, with 'silent' and 'register' flags enabled. In the context of a feeder/drinker behavior-monitoring skill, this is unjustified and dangerous because it creates remote accounts and transmits identity data without a clear user-triggered need or disclosure.
The skill declares no explicit tool scope or permission boundaries, yet its documented behavior and associated capabilities indicate shell execution, network access, file access, and environment use. This creates an over-privileged and opaque execution model that increases the chance of unintended command execution, data access, or exfiltration if the skill or its dependencies behave unexpectedly.
The history-report trigger phrases are broad enough that ordinary user requests such as asking to view reports or records could invoke account-scoped cloud queries unexpectedly. Because the skill states these queries must directly call a cloud API and silently use internal identity association, overly broad triggers increase the risk of unintended data disclosure or surprising remote actions.
The argument parser description and help text describe a livestock feeding/drinking behavior monitor, yet the --pet-type option only accepts "cat", "dog", and "other". This is an active contradiction between the user-facing documentation in code and the implemented interface, suggesting the code was repurposed from a pet-oriented skill without aligning intent.
The script silently resolves an internal user identity via OpenIdUtil.resolve_current_open_id while suppressing the --open-id option from help output. Hidden identity binding can cause actions, history retrieval, or analysis records to be associated with an internal account without meaningful user awareness, which increases privacy and auditability risks in a video-analysis workflow.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Multiple user-facing strings are hardcoded in Chinese, which imposes a specific language on users without opt-in or locale selection. The policy requires not forcing a language or locale unless the skill clearly offers a choice or documents a justified regional constraint.
When a local path is provided, the skill reads the entire file and uploads it to a remote analysis service, but this code contains no user-facing disclosure, consent check, or indication that local content will leave the host. Because the skill processes camera footage of livestock operations, uploaded files may contain sensitive operational or location information, creating privacy and data-governance risk if users assume analysis is local.
The code accepts either a local file path or a remote URL and passes it directly into skill.get_output_analysis(), which likely sends the referenced content to a backend service for processing. There is no clear user-facing consent, disclosure, destination validation, or restriction on what local files/URLs may be submitted, so users may unintentionally expose sensitive video data or trigger server-side fetching of untrusted URLs.