ClawHub
Back to skill

Security audit

Feed Intake Estimation | 畜禽采食量估算

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its feed-video analysis purpose, but it silently creates or reuses cloud identities, stores account tokens, and exposes cloud history access in ways that need review before installation.

Review this skill carefully before installing. It sends media or media URLs to a remote service, automatically creates or reuses a cloud identity, stores returned tokens locally, and can list cloud report history. Only use it in an isolated workspace with trusted users, and avoid installing it until identity override, token storage, and import-path behavior are tightened.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/smyx_feed_intake_estimation_analysis.py:42
Finding

Unverified hidden identity parameter enables cloud-account impersonation

Content
View full analysis

Vulnerability Details

File Location: scripts/smyx_feed_intake_estimation_analysis.py:42,59; supporting authentication flow in skills/smyx_common/scripts/util.py:550-566,576-612
Vulnerability Type: Improper authentication and untrusted identity assertion
Risk Level: High

Complete Code Snippet

python
# scripts/smyx_feed_intake_estimation_analysis.py

parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS)

# ...

# Initialize the internal user identity.
OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))

if args.list:
    open_id = ConstantEnum.CURRENT__OPEN_ID
    result = show_analyze_list(open_id)
    print(result)
    exit(0)
python
# skills/smyx_common/scripts/util.py

def _get_or_create_user(username):
    _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin"
    open_id = username
    _data = {
        "silent": 1,
        "register": 1,
        "openId": open_id,
        "mobile": username,
        "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
    }
    try:
        _response = requests.post(_url, json=_data)
        if _response.status_code == 200:
            _response_json = _response.json()
            if _response_json and _response_json.get("success"):
                return _response_json and _response_json.get("result")
    except Exception as _e:
        CommonUtil.trace_exception_stack(_e)
    return {}

# ...

current__user_name = (
    ApiEnum.API_SECRET_KEY
    or ConstantEnum.CURRENT__USER_NAME
    or ConstantEnum.CURRENT__OPEN_ID
)

if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name:
    # ...
    if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
        new_current_user = _get_or_create_user(current__user_name)
        if new_current_user:
            ApiEnum.TOKEN = new_current_user.get("token")
            ApiEnum.OPEN_TOKEN = new_current_user.get("openToken")

# ...

headers.setdefault("X-Access-Token", ApiEnum.TOKEN)
headers.setdefault("X
...[truncated 2920 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the caller-controlled --open-id option from the public executable entry point.
  2. Accept identity only from an authenticated, integrity-protected upstream channel.
  3. Use signed identity assertions containing an issuer, audience, subject, expiration time, and nonce.
  4. On the server, disable identifier-only silent login and require proof of identity ownership before issuing tokens.
  5. Bind all report-list and analysis operations to the subject encoded in the authenticated token rather than a separate username or Open ID field.
  6. Reject attempts to override an identity already established by the trusted runtime.
  7. Avoid using the same value as both openId and mobile.
  8. Add authorization tests proving that one authenticated identity cannot list, retrieve, or create reports for another identity.
  9. Invalidate tokens previously issued through the identifier-only flow if the server currently permits it.

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/smyx_feed_intake_estimation_analysis.py:4
Finding

Shared temporary directory is prepended to Python module search path

Content
View full analysis

Vulnerability Details

File Location: scripts/smyx_feed_intake_estimation_analysis.py:4-7,19-21
Vulnerability Type: Python import-path hijacking
Risk Level: High

Complete Code Snippet

python
import sys
import os

current_dir = os.path.dirname(os.path.abspath(__file__))
parent_dir = os.path.dirname(os.path.dirname(os.path.dirname(current_dir)))
sys.path.insert(0, parent_dir)

# ...

from .config import *
from .skill import skill

from skills.smyx_common.scripts.util import RequestUtil, OpenIdUtil

Technical Analysis

For the audited deployment path:

text
/tmp/clawhub-codex-scan-v571mr1ms1mq16fqz7705mtk7x8fcyj9-PAeuye/artifact/scripts/

the three nested dirname() calls resolve parent_dir to /tmp. The code then inserts /tmp at index zero of sys.path, giving modules in that shared directory precedence during absolute imports.

The subsequent import of skills.smyx_common.scripts.util therefore trusts an absolute package resolved through a shared, commonly writable temporary directory. A separate local user who can create /tmp/skills before the Skill starts can supply package initialization files and a replacement util.py. Python executes module-level code during import, so no explicit exec() call is required.

This crosses a local-user trust boundary: files created by another user in a shared directory can become executable code inside the Skill process.

Attack Path

  1. A lower-privileged local attacker creates a malicious package hierarchy in the shared temporary directory:
    text
    /tmp/skills/
  __init__.py
  smyx_common/
    __init__.py
    scripts/
      __init__.py
      util.py
  2. The attacker places arbitrary Python code in one of the imported package initialization files or in util.py.
  3. A victim invokes the audited Skill from its supplied deployment path.
  4. The entry point computes parent_dir as /tmp and executes:
    python
    sys.path.insert(0, "/tmp")

...[truncated 1037 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the manual sys.path.insert() operation.
  2. Package and install the project using a standard Python packaging mechanism, then use package-relative imports.
  3. If runtime path initialization is unavoidable, resolve the exact project root rather than walking a fixed number of parent directories.
  4. Never prepend /tmp, another shared writable directory, or a directory writable by untrusted users to sys.path.
  5. Validate candidate import roots with os.path.realpath() and verify ownership and permissions before use.
  6. Run the Skill from a protected installation directory owned by the executing account or an administrator.
  7. Use isolated virtual environments and avoid inheriting uncontrolled PYTHONPATH entries.
  8. Add a startup assertion that imported modules’ resolved __file__ paths remain inside the expected project or installation root.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (57)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The detected behavior includes network communication, authentication/token management, automatic account creation/login using openId/mobile, local key/open-id file reads, and user persistence, none of which are reflected in the simple feed-estimation description. Concealed authentication and identity bootstrapping are particularly sensitive because they can silently expand access to user-linked remote data and local secrets.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "smyx-feed-intake-estimation-analysis"
description: "Estimates daily feed intake per livestock individual from continuous feeder videos by tracking the change of feed remaining in the trough, and outputs intake trend with anomaly alerts. | 通过食槽视频估算每日采食量变化，异常时预警。"
version: "1.0.13"
license: "MIT-0"
---

# 🥣 Livestock Feed Intake Estimation | 畜禽采食量估算

> 通过食槽视频估算每日采食量变化，异常时预警。
>
> **精准饲喂计量中枢** · 食槽区域连续视频智能分析 · 剩余料量变化估算 · 每日采食量趋势 · 异常预警 · 历史报告

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The model stores sensitive authentication/profile-like fields including token, open_token, email, and birthday without any evident need tied to video-based feed intake analysis. Retaining these fields in a local SQLite database materially raises confidentiality impact: compromise of the workspace or overbroad DAO access could expose credentials, personal data, and account-linkage artifacts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The utility layer performs remote account provisioning and login through /sys/phoneLogin, automatically creating or rehydrating identities and storing returned tokens. That behavior is unrelated to feed-intake video analysis and creates hidden authentication side effects, external account linkage, and silent transmission of identity data to a remote service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and instructs use of shell, network, file read/write, and environment-dependent behavior, but does not declare an explicit tool scope such as allowed-tools or permissions. This weakens least-privilege enforcement and makes it harder for a host agent to constrain what the skill can access, especially since the workflow includes command execution and remote API interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The history-query trigger phrases are broad enough that ordinary user requests about reports may automatically invoke cloud history retrieval. In a skill that also auto-associates internal identity, this increases the chance of unintended access to account-linked historical data without clear user intent or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow says uploaded files are automatically saved locally, but does not provide a user-facing warning, retention policy, or storage boundary. Silent local persistence of user-supplied media increases privacy risk, especially for sensitive operational footage and in environments with shared workspaces or weak cleanup controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill claims to perform feed-intake estimation from video, but this file also exposes a report-history listing path keyed by user identity. That creates a data-access capability beyond the stated purpose, increasing the risk of unauthorized access to prior analysis records or metadata if identity handling or authorization is weak elsewhere in the stack.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code resolves and uses an internal open_id even though the advertised function is local/video-based feed-intake estimation. Introducing hidden identity resolution expands the skill's privilege surface and can enable user tracking or access to account-scoped data without a clear user need, especially because the parameter is suppressed from help text.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Multiple user-visible strings are hardcoded in Chinese, such as the analysis report header and export-link text. The file does not provide any opt-in, locale selection, or justification that this skill is intentionally limited to Chinese-speaking users, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill transmits either a remote video URL or raw file content to an analysis service without any visible user-facing disclosure, consent prompt, or data-handling notice in this code path. For video data, this can create privacy and data-governance risk because users may not realize media content is being uploaded or relayed to another service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes report-listing and report-export URL functionality that goes beyond the manifest's stated purpose of estimating feed intake and anomaly alerts. Extra data-access features increase the attack surface and may expose historical analysis records or report artifacts to users or callers who only expected single-analysis behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2