Fish Egg Incubation Stage Identification | 鱼卵孵化状态识别

• Outcome: Review
• Latest audit: Jul 8, 2026 · 5:31 AM UTC
• Version: 1.0.4

Overview

The skill appears to do fish-egg incubation analysis, but it also silently links a local identity, stores tokens, and sends media or URLs to cloud services with limited user control.

Install only if you are comfortable with fish-egg images or video URLs being sent to the publisher's cloud service, a local identity and token database being created or reused, and prior reports being fetched through that identity. Prefer a version that asks before uploads or history lookup, explains retention and account linkage, and avoids storing bearer tokens locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises no explicit permissions while the manifest and workflow instruct file handling, shell execution, network access, and local persistence behavior. This creates a transparency and governance gap: users and orchestrators may invoke a skill with broader capabilities than expected, increasing the chance of unintended data access, file writes, or outbound transmission.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is vision-based fish-egg stage analysis, but the behavior includes identity creation/resolution, token acquisition, local persistence, cloud history retrieval, and generic remote API processing. This mismatch is dangerous because users may provide images expecting narrow analysis while the skill silently links identity, stores data locally, and transmits content to external services beyond the stated scope.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The implementation accepts generic local files and arbitrary HTTP(S) URLs for "video" analysis, which is broader than the declared fish-egg fixed-camera incubation use case. This scope mismatch is dangerous because it can bypass user and platform expectations, enabling the skill to process unrelated media and potentially exfiltrate or misuse data under a misleading manifest.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code accepts any remote HTTP(S) URL and forwards it to the analysis backend without visible restriction. In this skill context, that capability is unnecessary for a fixed breeding-tank camera workflow and increases risk of SSRF-like backend fetching, analysis of unauthorized external content, and silent transmission of user-supplied remote resources to third-party services.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially diverges from the declared fish-egg image incubation analysis purpose by providing generic video analysis and history-listing behavior. That mismatch is dangerous because users, reviewers, or policy gates may grant this skill broader trust than warranted, while the actual code can process unrelated media and expose or retrieve prior analysis data outside the expected scope.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Accepting arbitrary remote URLs expands the skill from fixed-camera/local capture analysis into network retrieval of attacker-controlled content. This can enable misuse such as processing untrusted external media, bypassing expected data-origin controls, and potentially creating SSRF-style exposure if downstream components fetch internal or sensitive URLs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a generic HTTP/CRUD wrapper that can send arbitrary GET, POST, PUT, and DELETE requests to caller-supplied URLs, which is far broader than the skill’s declared purpose of image-based fish-egg incubation analysis. In a skill context, this expands the trust boundary substantially: any upstream component that can influence the URL or payload can repurpose the skill as a general network client or remote action proxy, enabling unintended data exfiltration, SSRF-like access patterns, or unauthorized calls to external/internal services.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code exposes write-capable remote operations (add, edit, delete, POST, PUT, DELETE) without any domain-specific guardrails, despite the skill being described as analysis-oriented rather than administration or resource management. That mismatch is dangerous because it allows the skill to be used as a generic remote modification primitive, increasing the chance of abuse if an attacker or compromised component can route requests through it.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This fish-egg incubation skill includes a shared DAO that persists user identities and tokens, which is unrelated to the declared camera/image-analysis function and materially expands the data-collection surface. In a least-privilege review, storing usernames, emails, tokens, and profile fields without clear necessity is dangerous because it enables unnecessary credential/PII retention and increases the blast radius of compromise.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model defines account/profile and token-management fields such as token and open_token despite the skill being described as fixed-camera fish egg stage analysis. In this context, unexplained identity and token handling is especially suspicious because it is orthogonal to the advertised functionality and could facilitate credential storage, cross-skill tracking, or later misuse if the local database is accessed.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This fish-egg incubation skill contains a generic `ai_chat` capability that can accept arbitrary prompts and is not constrained to the declared image-analysis purpose. Even though subprocess execution is currently commented out, the code structure clearly introduces an unnecessary general agent interface that could later be wired to broader capabilities and used outside the intended domain.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The implementation adds a general agent-execution abstraction to a narrowly described aquaculture vision skill, violating least privilege and expanding the attack surface. In this context, such hidden generality is risky because consumers of the skill would reasonably expect only deterministic image-stage analysis, not free-form agent interaction.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This shared utility performs remote account lookup/provisioning and token bootstrap logic that is unrelated to fish-egg incubation analysis. Embedding identity creation and authentication side effects inside a generic HTTP helper can silently register users, fetch tokens, and couple any skill invocation to external account operations without clear user consent or necessity.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The code reads data/smyx-api-key.txt and repurposes its contents as an internal open-id identity value. For a camera-based incubation analysis skill, silently deriving identity from a workspace credential file creates unnecessary credential coupling and can expose or misuse a sensitive workspace secret for unrelated backend actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The utility generates synthetic local user identities, persists them, and reuses them automatically when no explicit identity is provided. This creates hidden state and enables backend actions to be performed under fabricated or implicit identities, which is unnecessary and risky for a fish-egg image analysis skill.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The default trigger is broad enough to auto-invoke the skill for many generic fish-egg image requests, which can cause unintended file saving, network submission, or cloud history access without clear user intent. In agent environments, over-broad triggers increase the risk of surprise data handling and mistaken tool activation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow states that uploaded attachments are automatically saved locally, but the skill does not present this as a prominent user-facing privacy warning. Silent local persistence can expose sensitive media to other processes, operators, or retention beyond user expectations, especially for laboratory or commercial hatchery environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill auto-fetches historical reports from a cloud API using internally managed identity linkage, but this data flow is not surfaced as a strong privacy warning. Hidden identity association and remote retrieval can expose prior records tied to a user or facility without sufficiently informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill reads local file contents into memory or passes a remote URL to an analysis API, but this code shows no user-facing disclosure, consent, or transmission warning. That is dangerous because users may reasonably believe analysis is local or purpose-limited, while sensitive media can be uploaded or shared with an external service without informed approval.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The debug log prints the full prompt content, which may include sensitive user data, proprietary operational details, or downstream instructions. If debug logging is enabled in production or logs are centrally collected, this creates an information disclosure channel that is especially inappropriate for an ostensibly domain-specific analysis skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The request helper automatically attaches user identifiers and authentication headers to outbound requests, but this file provides no non-debug disclosure, consent, or visible boundary to the caller. In the context of an image-stage analysis skill, hidden transmission of identifiers and tokens to remote services increases privacy and account misuse risk because these network side effects are not obviously required by the stated functionality.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This utility reads a sensitive credential file from the workspace without any user-facing disclosure or narrow purpose binding. For a skill whose declared purpose is local image analysis of fish eggs, accessing hidden workspace credentials is disproportionate and raises the risk of secret misuse or unexpected identity propagation.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

| 🔎 使用提醒 | **4 级提醒策略递进**（info → important → urgent → warning），偏育苗助手定位（非健康告警） |
| 🔎 使用提醒 | 单日提醒上限：Level 1 不限 / Level 2 × 4 / Level 3 × 6（破壳事件可能密集）/ Level 4 × 2 |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **禁止**做"水霉感染 / 真菌污染 / 受精率不足 / 亲鱼不孕"等具体疾病或繁殖学诊断 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案（特别**严禁推荐甲基蓝、二氯异氰尿酸钠等防霉化学剂**） |
| 🔎 使用提醒 | **禁止**长期存储完整鱼缸视频/图像（≤ 14 天，仅入库孵化阶段事件帧；公共育苗场/实验室按管理规定） |
| 🔎 使用提醒 | **禁止**用于商业广告 / AI 训练；禁第三方共享 |

• Confidence: 72% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-fish-egg-incubation-stage-analysis"
description: "Through breeding-tank fixed cameras (macro lens), the system periodically captures high-definition images of fish eggs and uses AI vision analysis to detect egg color changes (transparent → white / black) and embryonic eye-spots (small black dots), identifying incubation stages (unfertilized / early / mid / late-eyespot / hatching). | 通过繁殖缸固定摄像头（微距镜头），定期拍摄鱼卵的高清图像，利用 AI 视觉分析技术检测鱼卵颜色变化（透明 → 发白/发黑）以及胚胎眼睛点（黑色小点）的出现，识别鱼卵的孵化阶段（未受精/早期/中期/晚期/破壳）。系统定时（如每 6 小时）自动分析，输出孵化阶段及建议（如'已出现眼睛点，预计 24 小时内孵化，准备丰年虾'）。"
version: "1.0.2"
license: "MIT-0"
---

• Confidence: 76% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2