Fish Flashing & Scraping Detection (Ectoparasite Warning) | 鱼类擦缸/蹭底行为识别（外寄）

• Outcome: Review
• Latest audit: Aug 21, 2026 · 9:12 PM UTC
• Version: 1.0.9

Overview

The skill is mostly a disclosed cloud video-analysis integration, but it also automatically creates or reuses identities, stores service tokens locally, and performs cloud history lookups without clear user-directed control.

Install only if you are comfortable with aquarium videos, video URLs, report history requests, and identity-linked metadata being sent to the configured cloud service, and with the skill creating local account/token state in the workspace data directory. Review the configured endpoints and avoid using it with sensitive footage or shared workspaces unless identity and retention behavior are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: This query builder uses getattr(self.__model__, key) on keys from the caller-supplied filters dict without validating that the field is allowed. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still trigger unauthorized filtering on internal columns, errors on nonexistent attributes, or unintended access patterns that may expose or manipulate records in ways the application did not intend.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: The count() method has the same unchecked dynamic field access pattern as list(), allowing caller-controlled filter keys to drive which model attributes are queried. This can enable unauthorized introspection of sensitive fields, application errors, and misuse of a generic data-access primitive beyond the intended skill behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises substantial capabilities—environment access, file read/write, network access, and shell execution—without declaring corresponding permissions or constraining their use. This creates a transparency and least-privilege failure: reviewers and users cannot accurately assess what the skill may access or execute, and the included shell/API workflow expands the attack surface beyond simple video analysis.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes automatic cloud history-report querying and report-link retrieval that goes beyond the narrow purpose of analyzing a user-provided fish video. This expands data access and can expose prior reports or linked resources without sufficient scope restriction, increasing privacy and data-minimization risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented workflow silently manages internal identity and may reuse or create a default local user, despite this being unnecessary for basic fish-behavior analysis. Hidden identity binding can cause cross-user data exposure, misattributed report access, and unauthorized retrieval of another user's historical records, especially when combined with automatic cloud queries.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest frames the skill as local behavior-video analysis, but the workflow delegates core actions to scripts and external API/cloud services. This mismatch is dangerous because it obscures where user data is processed and transferred, preventing informed trust decisions and weakening review of data-handling boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI exposes a record-listing capability (`--list`) that retrieves prior warning history via `skill.get_output_analysis_list(open_id=...)`, even though the skill description focuses on video behavior analysis. This expands the tool from local inference into access to historical per-user data, creating an unnecessary data exposure surface if identity resolution or authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script initializes internal user identity with `OpenIdUtil.resolve_current_open_id(...)` and then uses `ConstantEnum.CURRENT__OPEN_ID` to access per-user records, despite the primary function being video analysis. Tying analysis execution to hidden identity state increases the risk of unintended account linkage, privacy leakage, or unauthorized access to another user's history if identity resolution is misconfigured or spoofable.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill’s declared purpose is aquarium video behavior analysis, but the CLI accepts arbitrary remote URLs as input. This expands the trust boundary and can enable unintended external fetching, privacy leakage, or SSRF-like behavior in downstream processing if internal or sensitive URLs are supplied to the analysis backend.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The script exposes a history-listing function that is not reflected in the skill description, creating hidden capability beyond the stated behavior. Undocumented access to analysis history can reveal prior user activity or metadata and violates least surprise and least privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code imports and uses an OpenID-based identity mechanism despite the skill being described as a narrow local video-analysis tool. Introducing identity resolution broadens data handling and can tie analysis actions to user accounts, increasing privacy and access-control risk, especially when paired with history retrieval.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes broad generic HTTP and CRUD helper methods that can call arbitrary URLs and perform add, edit, delete, get, put, and post actions, which substantially exceeds the narrowly declared purpose of analyzing fish flashing/scraping behavior. In a skill context, this creates a capability mismatch: if other parts of the skill or calling code are influenced by untrusted input, the wrapper can be repurposed for unintended remote actions, data access, or destructive operations.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The get_user_by_username helper introduces user-account lookup capability that has no clear relation to aquarium video analysis or parasite-risk detection. Unnecessary identity-related access expands the attack surface and may enable user enumeration or privacy-impacting lookups if exposed through the skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file implements persistent user-account storage and mutation logic that is unrelated to the stated fish-behavior detection purpose. In a narrowly scoped video-analysis skill, retaining identity-linked records expands the attack surface and creates unjustified privacy and data-governance risk if the skill is compromised or misused.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The User model stores identity and authentication-related fields including email, birthday, token, and open_token, none of which are justified by a fish-health monitoring workflow. Persisting these secrets and personal data locally creates substantial privacy and credential-exposure risk, especially because tokens appear to be stored directly rather than protected as secrets.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: DAO initialization automatically creates and alters local database tables, introducing durable state changes that go beyond the manifest's described analytics-only behavior. In this skill context, unexpected local persistence increases the risk of stealthy data retention, schema drift, and hidden coupling to unrelated features.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This shared utility performs outbound authentication, token handling, local token persistence, and implicit account provisioning even though the declared skill purpose is aquarium video analysis. That mismatch is dangerous because the code can create external identities and transmit user-linked data without clear user consent, expanding the skill's privilege and data exposure far beyond what is needed for fish-behavior detection.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code generates or reuses default open-id identities, reads an identity from a local workspace file, and persists synthetic users in a local database when no caller identity is supplied. For a fish flashing/scraping detector, silently assigning identities is unjustified and can lead to unauthorized account creation, cross-session tracking, and user confusion about which identity is being used externally.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The utility enumerates agent workspace structure and creates shared data/skills directories, capabilities not justified by simple aquarium video analysis. While not inherently malicious, this broadens filesystem awareness and write scope, increasing the chance of unintended cross-agent data access, persistence, or environment pollution if reused by other parts of the skill.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The default trigger activates on broadly described aquarium video analysis requests, which can cause the skill to run in situations the user did not specifically intend. Over-broad invocation increases the chance of unnecessary file handling, data transfer to external services, and accidental processing of unrelated or sensitive content.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The history-report query keywords are broad and auto-trigger cloud lookups without strong scope limits. This can initiate retrieval of historical data based on vague phrasing, increasing the risk of unauthorized or accidental disclosure of report metadata and links.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill uploads either a local video file's full contents or a user-supplied remote video URL to an external analysis service without any visible user-facing notice, consent step, or disclosure in this code path. For a camera/video analysis skill, that creates meaningful privacy and data-handling risk because potentially sensitive footage and metadata may be transmitted off-device or to a remote backend unexpectedly.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The CLI accepts a hidden API key parameter without clear user-facing disclosure that credentials may be used for remote service interaction. Hidden credential-bearing options reduce transparency, making accidental secret exposure or misuse more likely in automation, shell history, or wrapper integrations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Enabling HTTPConnection and urllib3 debug logging can expose full request and response details, which commonly include tokens, identifiers, URLs, and payload contents. Even if intended only for debugging, this creates a realistic confidentiality risk because the same utility also handles authentication and outbound requests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code reads a credential-like or identity-like value from data/smyx-api-key.txt without transparent user disclosure or validation of whether the value should be used for this skill. In context, this is risky because it silently binds the skill's outbound behavior to a workspace-stored secret or identity unrelated to aquarium analysis.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2