Back to skill

Security audit

Fish Feeding Behavior Activity Analysis | 鱼类摄食行为活跃度分析

Security checks across malware telemetry and agentic risk

Overview

This is mainly a cloud fish-feeding video analysis skill, but it needs Review because it silently provisions or reuses an identity, stores tokens locally, and sends identity-linked data to a backend.

Review before installing if you are not comfortable with aquarium camera media and history requests being processed by the lifeemergence.com backend, with the skill silently creating or reusing a local identity and storing reusable tokens in a workspace SQLite database. Prefer installation only in a workspace where that account linkage and local token persistence are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions while its documented behavior includes shell execution, network access, local file reads/writes, and environment use. This creates a transparency and consent gap: a host or reviewer may treat it as low-risk even though it can download/upload data, persist files, and invoke local commands.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill is presented as a local fish-feeding video analysis tool, but the documented behavior also includes backend history retrieval, automatic identity initialization/creation, local token persistence, and generic report/export API usage. That mismatch can mislead users and platforms about what data is collected, where it is sent, and what persistent account linkage occurs.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill manifest describes fish-feeding video analysis, but this code also exposes a history-listing function via `show_analyze_list(open_id)` that retrieves prior analysis records. That creates undocumented data-access capability and can leak user-associated historical data if invoked in contexts where callers were only meant to submit a single video for analysis.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code resolves an internal `open_id` and uses `ConstantEnum.CURRENT__OPEN_ID` for listing records, even though identity handling is unrelated to simple fish-video scoring. This introduces hidden coupling to internal user identity and expands the skill from media analysis into account-scoped data access, increasing the risk of cross-user data exposure or unauthorized history retrieval.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill accepts arbitrary HTTP(S) URLs and forwards them for backend analysis, which expands its effective capability beyond the stated camera-capture workflow. This can enable unintended server-side fetching of attacker-controlled resources, privacy issues, or abuse of the analysis service to process external content outside the expected trust boundary.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes generic CRUD and arbitrary HTTP wrapper methods (add, edit, delete, http_get/post/put/delete) that are not constrained to the fish-feeding analytics use case. In a skill that is described as analytics-only, these broad network capabilities expand the attack surface and could be reused by other components to access or modify unrelated remote resources.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code supports remote creation, modification, and deletion through add, edit, and delete wrappers even though the manifest describes read/analysis behavior rather than state-changing operations. This mismatch is dangerous because a higher-level workflow or prompt-influenced caller could invoke these methods to alter remote systems outside the user's expected scope.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file provides a shared DAO layer that creates, updates, and deletes a local sys_user database with identity-oriented records, which is materially unrelated to fish feeding activity analysis. In a skill whose declared purpose is post-feeding video analytics, hidden user-database management expands data collection and persistence scope, increasing privacy, abuse, and unauthorized state-manipulation risk.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores usernames, real names, email, birthday, token, and open_token, which are sensitive identity and authentication-related fields not justified by the skill description. If compromised or misused, this could expose personal data and reusable tokens, enabling account takeover or cross-system access far beyond aquarium analytics.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The DAO exposes broad create, update, modify, save, and delete operations despite the skill being described as a passive analytics function. This mismatch increases the attack surface for unauthorized state changes and data tampering, especially if other components can call these generic methods with untrusted input.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility file contains account provisioning, token handling, and outbound API request logic that is unrelated to fish-feeding video analysis. In the context of this skill, that behavior materially expands data access and exfiltration capability, enabling silent transmission of identifiers, token reuse, and remote service interaction beyond what users would reasonably expect.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads or creates persistent user identities, reuses workspace-stored identity material, and writes local user records without a clear functional need for aquarium feeding analysis. That creates hidden identity state and tracking across runs, which can be abused for unauthorized attribution, account linkage, or covert persistence.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workspace and agent introspection logic discovers execution context, root directories, and per-agent storage locations more broadly than needed for video scoring of fish feeding. While not directly exploitative on its own, this capability increases the skill's ability to enumerate environment structure and access or place files across agent workspaces.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The history-query auto-trigger phrases are broad enough that normal user language could invoke cloud history retrieval unexpectedly. In a skill that auto-associates user identity and queries remote records, ambiguous triggering can cause unintended disclosure of prior reports or unnecessary backend access.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow states that uploaded attachments are automatically saved as local files, but the skill description does not clearly warn users about this persistence. Silent local storage increases privacy and retention risk, especially for camera media that may reveal homes, tanks, locations, or operational details.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads the full local file into memory and uploads it for analysis without any visible disclosure, confirmation, or minimization in this code path. For camera/video content, this can expose sensitive imagery or metadata to external services without clear user awareness, creating privacy and compliance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt and treats it as an open-id without any user-facing disclosure in this file. This creates a hidden trust channel from local workspace state into account selection, which can surprise users and enable unintended identity reuse or impersonation if the file is modified.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The request logic assembles headers and request bodies containing user-linked identifiers and tokens, then performs outbound HTTP calls without any visible user notice in this file. In a fish-feeding analysis skill, undisclosed transmission of identity-bearing data is more suspicious because the core function should primarily process video/media, not silently broker authenticated remote account activity.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | **4 级告警策略递进**(slightly_low → appetite_decline → severe_appetite_loss → total_refusal/Level 4),连续 ≥ 3 餐异常进入 Level 4 |
| 🔎 使用提醒 | 单日告警上限:Level 1 不限 / Level 2 × 4(按投喂次数)/ Level 3 × 2 / Level 4 不设上限(紧急安全优先) |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **禁止**对鱼做"肠炎 / 寄生虫 / 鳃病 / 细菌感染 / 应激综合征"等具体疾病诊断 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案 |
| 🔎 使用提醒 | **禁止**长期存储完整鱼缸/养殖池视频(≤ 7 天,仅入库异常摄食事件片段;公共养殖场按管理规定) |
| 🔎 使用提醒 | **禁止**用于商业广告 / AI 训练;禁第三方共享 |
Confidence
62% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-fish-feeding-activity-analysis"
description: "Through built-in cameras of smart feeders or fixed cameras on aquariums, the system captures fish feeding videos after feeding. Using AI object detection and motion analysis, it identifies the number of fish gathering for food, feeding intensity (fish swimming speed, feeding action frequency), and remaining feed amount, and computes a comprehensive feeding activity score (0-100). | 通过智能喂食器内置摄像头或鱼缸固定摄像头,在投喂后拍摄鱼群摄食视频,利用 AI 目标检测和运动分析技术,识别鱼群聚集抢食的数量、摄食强度(鱼只游动速度、摄食动作频率)以及剩余饲料量,综合计算摄食活跃度评分(0-100 分)。当活跃度评分低于阈值时,输出'食欲下降'提示,可能预示疾病、水质恶化或应激反应。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
73% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2