Feed Intake Estimation | 畜禽采食量估算

• Outcome: Review
• Latest audit: Aug 22, 2026 · 6:06 AM UTC
• Version: 1.0.9

Overview

The skill performs the advertised cloud feed-video analysis, but it also quietly creates or reuses a persistent service identity, sends that identity to external services, and stores returned tokens locally.

Review this skill before installing. It sends feeder videos or URLs to the lifeemergence cloud service, can fetch cloud report history, creates or reuses a local identity, and may store service tokens in a workspace SQLite database. Install only if you trust that service and are comfortable with persistent identity and token handling in the workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 73% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 73% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and instructs use of capabilities including shell execution, network access, file read/write, and environment use, but does not declare permissions or constrain them in the manifest. This creates a mismatch between apparent privilege and documented trust boundaries, making it harder to review and increasing the chance of unsafe execution of local scripts and remote API calls.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill exposes a history-report listing capability (`show_analyze_list`) that goes beyond the declared purpose of estimating feed intake from a supplied video. In combination with the internal identity handling elsewhere in the file, this expands the accessible data surface and could enable unauthorized access to prior analysis records if caller identity and authorization are not strictly enforced downstream.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code initializes and uses an internal user identity (`open_id`) even though the primary skill purpose is local or URL-based video analysis. Hidden identity resolution creates a risk of implicit privilege context, cross-user data access, or unintended linkage to internal accounts, especially because the `--list` path uses the resolved identity to retrieve historical reports.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The skill exposes a report-listing function that is broader than the stated purpose of estimating feed intake from a supplied feeder video. Because the code comments out open_id checks and directly calls page(), it may allow enumeration or retrieval of analysis records without an explicit access-control check in this layer, increasing the risk of unintended data exposure if the backend is permissive.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill exposes a history-listing capability via `show_analyze_list()` that is not aligned with the declared purpose of estimating feed intake from submitted videos. Hidden or undocumented data-access features increase the attack surface and can allow users or integrators to enumerate prior analysis records, potentially exposing metadata or results beyond the expected scope of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code resolves a hidden `open-id` and uses `CURRENT__OPEN_ID` for listing operations even though user-identity handling is not justified by the stated video-analysis function. Introducing concealed identity-based behavior can enable cross-user data access or silent collection/use of identifiers, especially when combined with the historical listing path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file implements generic user/account persistence in a skill whose declared purpose is livestock feed-intake video analysis. This unjustified expansion of scope increases attack surface, introduces identity and token handling not needed for the advertised function, and makes hidden data collection or cross-feature abuse more plausible.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The User model stores identity fields plus token and open_token values, but the manifest describes only feed-intake estimation from feeder videos. Persisting authentication material without clear need creates unnecessary credential-exposure risk, especially in a local SQLite database with no visible encryption, secret management, or access controls in this file.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This utility module contains broad external account and token management behavior that is unrelated to the stated purpose of livestock feed-intake estimation from feeder videos. It can provision accounts, persist tokens, and perform authenticated outbound API calls, creating a hidden data-exfiltration and unauthorized-remote-access surface that is especially suspicious given the mismatch with the declared skill function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically logs in or registers users against an external health-service endpoint using locally derived identity values, without any clear relation to feed-intake analysis. This creates undisclosed account creation and identity transmission behavior, which could bind users or environments to external services and enable tracking, misuse of credentials, or unauthorized service consumption.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill reads, generates, and persists workspace identity data such as open-id values in local files and databases, even though that capability is not justified by video-based feed-intake estimation. Hidden persistence of identity state increases privacy risk, enables cross-session tracking, and supports the unrelated remote-authentication flow elsewhere in the module.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The historical-report auto-trigger phrases are broad enough that ordinary user requests about reports or records could invoke cloud API access without a clearly bounded intent check. In a skill that automatically associates an internal identity and fetches remote data, overbroad triggering can cause unintended data retrieval and exposure in the session.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently reads a sensitive identity value from data/smyx-api-key.txt and uses it as an internal identity source without notice to the user. This can cause unintended credential or identifier reuse across contexts and can covertly couple a local workspace to external service activity.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The HTTP request path attaches and transmits identity-bearing fields and tokens such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName without user-facing disclosure. In a skill whose declared purpose is video-based feed analysis, this hidden transmission is unjustified and increases the risk of privacy leakage, credential misuse, and unintended third-party correlation.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 分析结果仅为视觉估算与趋势提醒，本技能不提供饲喂调整或饲料配方建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 91% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-feed-intake-estimation-analysis"
description: "Estimates daily feed intake per livestock individual from continuous feeder videos by tracking the change of feed remaining in the trough, and outputs intake trend with anomaly alerts. | 通过食槽视频估算每日采食量变化，异常时预警。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 72% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2