Security audit
Security checks for vulnerabilities and agentic risk
The skill’s fish-video analysis purpose is real, but it also silently creates or reuses cloud-linked identities and stores authentication tokens locally, so users should review it before installing.
Install only if you are comfortable with a cloud-backed analysis service that uploads aquarium media or URLs, creates or reuses an internal cloud identity, retrieves cloud history reports, and stores local authentication tokens in the workspace. Prefer using it in a separate workspace and remove its local data files if you stop using it.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
The implementation reportedly reads a local API-key file, creates or retrieves user identities, persists them locally, and performs outbound HTTP login/token handling, while the description only promises fish flashing/scraping detection. This is a serious transparency and privacy issue because the skill appears to manage credentials and user-linked remote access under a misleading domain-specific façade.
This section defines a user/account model with identifiers, email, birthday, token, and open_token fields, which is unrelated to fish flashing/scraping video analytics. In the context of a narrowly described aquarium behavior detection skill, hidden account-management and credential-storage capability materially increases the risk of covert data collection or repurposing beyond user expectations.
The User model includes sensitive identity and authentication-related fields such as token and open_token, plus email and birthday, which are context-inappropriate for aquarium behavior detection. Storing such data in a local SQLite database increases the blast radius of compromise and suggests undeclared credential or profile handling outside the skill's stated mission.
This code resolves or creates persistent user identities, reads a local identity file, and stores default open-id values for future reuse even though the advertised skill is only fish abnormal-behavior detection. Persisting identities and tokens creates an unnecessary tracking and account-coupling surface that could be abused for unauthorized service enrollment or cross-skill correlation.
The utility layer performs remote account provisioning, token handling, and authenticated HTTP API calls that are unrelated to the stated fish-video analysis purpose. That mismatch materially increases risk because a seemingly local vision skill can silently establish external identities and transmit workspace-associated data, violating least privilege and user expectations.
The skill declares powerful capabilities in practice—shell execution, filesystem access, network access, and environment usage—without any explicit tool scope or permissions declaration. This increases the chance of overbroad execution, review failures, and accidental abuse because users and operators cannot easily tell what the skill is allowed to do.
The history-report trigger phrases are broad enough that ordinary user language may unintentionally invoke cloud-backed history retrieval. That can cause unexpected data access or off-device requests tied to a user identity without sufficiently clear intent confirmation.
The skill says uploaded attachments are automatically saved locally but does not present this clearly as a user warning near the input flow. Silent local storage of user media is a privacy and retention risk, especially for video files that may contain sensitive environmental details.
The historical report feature directly calls a cloud API and may transmit user-associated data off-device, but the skill description does not clearly warn users about this data flow. Lack of transparency around cloud transmission and identity-linked queries creates privacy, consent, and compliance concerns.
This code returns a user-facing string literal in Chinese, which enforces a specific language for the skill output. The file does not indicate any user opt-in, language selection mechanism, or justified region-specific requirement, so it may violate language/locale policy expectations.
The script includes a hidden --list capability that retrieves prior analysis history via skill.get_output_analysis_list(open_id=...), but this behavior is not aligned with the stated single-video analysis scope. Undisclosed data-access features increase the attack surface and can expose historical user data or prior results, especially when combined with internal identity resolution.
The code comments imply identity handling is internal and not user-facing, yet the program accepts a hidden --open-id parameter and processes it through OpenIdUtil.resolve_current_open_id(...). Hidden identity parameters create a mismatch between disclosed behavior and actual behavior, which can enable user confusion, unauthorized account targeting, or bypass of expected consent flows.
The script performs hidden identity resolution at startup without meaningful user-facing disclosure, setting current identity context before executing other actions. In a tool that can list prior analysis history, silent identity binding can cause privacy violations or cross-user data exposure if the resolved identity is incorrect, spoofed, or attacker-controlled.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Detected: suspicious.install_untrusted_source