Feeding/Drinking Behavior Monitoring | 畜禽采食/饮水行为监测

• Outcome: Review
• Latest audit: Aug 25, 2026 · 10:22 PM UTC
• Version: 1.0.10

Overview

The skill is not clearly malicious, but it needs review because it silently manages account/session state while uploading media and querying cloud reports.

Install only after confirming the publisher, the intended LifeEmergence endpoints, and whether it is acceptable for uploaded farm videos, submitted URLs, report history, local identity data, and session tokens to be handled by this service. Use an isolated workspace and review the default dev/private endpoint configuration before production use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises substantial capabilities—shell execution, network access, and local file read/write—without declaring permissions or narrowing their scope. This reduces transparency for reviewers and users, and makes it easier for a seemingly simple video-analysis skill to perform unexpected side effects such as local persistence or outbound data transfer.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is livestock behavior analysis, but the actual behavior includes hidden identity creation/reuse, local SQLite persistence, backend login/token acquisition, and historical report enumeration with export URLs. This mismatch is dangerous because operators may approve or invoke the skill under a low-risk assumption while it performs account-linked remote actions and data exposure workflows not obvious from the description.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This module exposes generic add/edit/delete and arbitrary HTTP GET/POST/PUT/DELETE wrappers that are not constrained to the stated livestock video-analysis purpose. In an agent skill context, broad network and CRUD primitives can be repurposed to access unrelated internal services, manipulate remote resources, or exfiltrate data if higher-level code passes attacker-influenced URLs or payloads.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The user account lookup helper introduces identity-query capability unrelated to feeder/waterer behavior analysis. While not inherently malicious, this expands the skill's accessible surface to include user enumeration or retrieval of account metadata, which can aid reconnaissance or privacy violations when exposed through an agent.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The file includes persistent user-account storage logic (username, realname, email, token, open_token) that is unrelated to a livestock video behavior-analysis skill. In this context, collecting and retaining identity and authentication-related data expands the skill's data handling scope and creates unnecessary privacy and credential exposure risk if the local SQLite database is accessed by other components or users.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The DAO constructor automatically creates and alters a local SQLite schema on initialization, which exceeds the apparent read/analysis role described for this skill. In a skill intended for video-based behavior monitoring, silent local state mutation increases attack surface, can retain sensitive data unexpectedly, and may enable cross-run or cross-skill data persistence in the shared workspace.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer performs authenticated remote API operations, token management, and even account bootstrap/login flows that are unrelated to the stated purpose of analyzing feeder/waterer video behavior. In a skill context, this creates an unnecessary capability for outbound data transfer and remote account interaction, expanding the attack surface and enabling misuse of local identity material and tokens.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads persistent identity material from workspace files, falls back to local database records, and auto-creates default user identities when none exist. For a livestock video-analysis skill, this is over-privileged and unnecessary, and it can silently bind actions to persistent identities without user awareness or authorization.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The workspace-discovery logic inspects runtime paths and environment variables to locate agent roots, then creates data and skills directories automatically. While not inherently malicious, these filesystem capabilities exceed what a fixed-camera behavior-analysis skill should need and increase the risk of cross-workspace access, unintended persistence, or pollution of other agent environments.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The auto-trigger rules for historical report queries are broad enough that normal conversational phrases could unintentionally invoke cloud-backed record retrieval. In a skill that is tied to internal identity association and remote report access, ambiguous triggering increases the risk of unintended data disclosure or execution of sensitive retrieval actions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script initializes and uses an account-scoped open_id through a hidden/suppressed CLI parameter and then exposes history via the --list path without clear user disclosure or an explicit authorization check in this file. Hidden identity handling increases the risk of unintended access to another user's historical analysis data, especially in shared environments or when wrapper tools invoke the script implicitly.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill reads arbitrary local files into memory and uploads them, or forwards arbitrary remote video URLs for analysis, without any user-facing consent notice or destination disclosure in this code path. In a skill context, that creates a data exfiltration/privacy risk because operators may unknowingly transmit sensitive local media or internal URLs to an external analysis service.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The code silently creates a database and mutates schema state without any user-facing disclosure or consent. In this skill context, that is risky because users would reasonably expect video analysis, not hidden persistent local storage, and undisclosed persistence can surprise operators and complicate privacy/compliance obligations.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: The code performs an external POST request to a health/login endpoint to provision or retrieve user state, transmitting identity fields such as openId and mobile. In the context of a video-behavior analysis skill, this outbound transmission is not clearly justified and can leak locally derived identity material to remote services without explicit user action.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 分析结果仅为行为统计与偏差提醒，本技能不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 71% confidence
• Finding: The finding indicates hidden or non-obvious instruction content embedded in the document, which can be used to influence agent behavior outside normal reviewer visibility. In an agent skill, concealed instructions are risky because they can suppress scrutiny, alter execution paths, or smuggle operational constraints that are not apparent during ordinary review.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-feed-drink-behavior-monitor-analysis"
description: "Analyzes fixed-camera videos of feeders and waterers to quantify livestock feeding duration, feeding bouts and drinking frequency, comparing them against individual baselines to raise behavior anomaly alerts. | 通过视频统计畜禽采食时长、饮水频次，异常时预警。"
version: "1.0.9"
license: "MIT-0"
---

• Confidence: 76% confidence
• Finding: The metadata and manifest structure contain indicators associated with tool/metadata poisoning, meaning the skill description or hidden text may be crafted to shape agent trust or behavior in ways not obvious to reviewers. Because agents often rely on manifest metadata for planning and routing, poisoning there can cause unsafe invocation, over-trust, or bypass of normal scrutiny.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2