Fish Gasping & Ammonia Poisoning Visual Warning | 水族箱内氨氮中毒视觉预兆（鱼浮头）

• Outcome: Review
• Latest audit: Aug 4, 2026 · 8:28 AM UTC
• Version: 1.0.10

Overview

The skill performs the advertised fish-video analysis, but it also silently creates or reuses a cloud identity, stores tokens locally, uploads media, and queries cloud history records.

Install only if you trust the LifeEmergence/Open API backend and are comfortable with aquarium media being uploaded for cloud analysis, automatic account/session creation, local storage of access tokens in the workspace data directory, and cloud retrieval of prior reports. Avoid giving it sensitive local files or broad history-query requests unless that account-linked behavior is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet the manifest instructs use of shell execution, local file read/write, environment-backed identity handling, and network access. This is dangerous because it obscures the real capability surface from reviewers and users, making it easier for the skill to access local data and remote services without clear consent or policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is fish-behavior analysis, but the behavior includes persistent local identity creation, local database use, remote login/token acquisition, and historical report access. This mismatch is dangerous because it hides sensitive data collection and account-linked remote operations behind an innocuous animal-health use case, increasing the chance of unauthorized data handling and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill exposes a history-listing capability via `show_analyze_list()` and the `--list` CLI path, which is outside the stated purpose of real-time aquarium video analysis and warning generation. Extra data-access functionality increases the attack surface and can enable unauthorized access to prior analyses or user-associated records, especially because it is tied to an internally resolved identity rather than an explicitly authenticated end-user flow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code resolves an internal user identity (`OpenIdUtil.resolve_current_open_id`) even though the skill’s declared function is aquarium symptom analysis, not account or history management. Hidden identity resolution creates a covert coupling between content analysis and user data access, which can lead to privacy violations or cross-user data exposure when combined with the listing functionality.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, even though the skill’s stated purpose is fixed aquarium camera analysis. This expands the trust boundary and can enable server-side fetching of attacker-controlled URLs, potentially causing SSRF-like access, unexpected data ingestion, or policy bypass if the backend resolves internal or sensitive network targets.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script exposes a history-listing capability tied to an OpenID, which is outside the stated purpose of analyzing current aquarium footage for gasping/ammonia-risk detection. Extra data-access features increase attack surface and can enable unauthorized enumeration or retrieval of prior analysis records if OpenID handling or backend authorization is weak.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Resolving and using an OpenID-based user context is not justified by the described fish-behavior video analysis workflow and introduces identity-linked data handling into a simple media-processing skill. Unnecessary identity context can lead to privacy leakage, cross-user data access, or misuse if the OpenID is spoofed, reused, or insufficiently authorized downstream.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: Accepting arbitrary remote video URLs broadens the skill from fixed aquarium-camera analysis into general network resource processing, which can be abused to make the backend fetch attacker-controlled or internal resources. Depending on how `skill.get_output_analysis` handles URLs, this may enable SSRF-style access, processing of untrusted content, or bypass of assumptions about trusted fixed-camera sources.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This file exposes a generic network/CRUD wrapper layer that can issue arbitrary GET/POST/PUT/DELETE requests and perform add/edit/delete/page/list operations, which is substantially broader than the declared aquarium-behavior warning function. In a skill context, unnecessary general-purpose remote access increases attack surface and creates a reusable capability for unintended data access, backend manipulation, or covert extension of behavior if other components pass attacker-controlled URLs or parameters.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code provides generic backend resource-management primitives such as add, edit, delete, list, and arbitrary HTTP methods, which go beyond symptom detection and warning generation described for this skill. This mismatch is dangerous because broad operational capabilities hidden inside a narrowly described skill can enable unauthorized state changes or data retrieval and make review, monitoring, and permission scoping much harder.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The file defines generic local user/account persistence, including personally identifying fields and account lookups, despite the skill being described as aquarium behavior analysis. This functionality expands the skill's data-handling scope without clear justification, increasing privacy and attack-surface risk if user records or tokens are collected, queried, or reused across skills via the shared workspace database.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The model stores token and open_token values in a local SQLite database without any visible encryption, scoping, rotation, or need tied to aquarium monitoring. Storing authentication material in plaintext-like local persistence creates credential theft and lateral-movement risk, especially because the DAO forces use of a shared workspace data directory that may be accessed by other components or skills.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote account provisioning, token retrieval, persistence, and request authentication even though the advertised skill is aquarium-camera distress analysis. This creates an unjustified identity and network side channel: merely using the skill can trigger external account creation/login behavior and token handling unrelated to fish-behavior detection.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads workspace identity files and local user records, then derives or creates an open-id for later network use. For a fish warning skill, harvesting or manufacturing persistent user identity from local workspace state is unnecessary and increases privacy risk, especially because it can silently bind the skill to a long-lived account.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The generic HTTP wrapper can send requests to arbitrary URLs and automatically decorates them with app identifiers, tokens, and user-related fields. In the context of a camera-based aquarium warning skill, this broad network capability is unnecessary and enlarges the attack surface for data exfiltration, misuse of credentials, or unintended third-party communication.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger activates on broadly described aquarium video analysis requests, which can cause the skill to run in situations the user did not specifically intend. Overbroad activation is dangerous because it can unexpectedly process files, call remote services, or persist data when the request only loosely matches the scenario.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The history-report query auto-trigger is keyed on broad phrases without clear boundaries, so ordinary conversation about past incidents may invoke cloud history retrieval. This is dangerous because it can disclose account-linked records or cause remote API calls without sufficiently explicit user authorization.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill reads arbitrary local file contents and transmits them to the analysis service without any user-facing disclosure or explicit consent flow in this path. Even if intended for video upload, this creates a privacy and data-handling risk because users may unknowingly send sensitive local content or metadata to a remote service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The request path automatically assembles and transmits usernames, open IDs, API keys, access tokens, and authorization tokens without any visible user-facing disclosure or opt-in. Even if intended for backend integration, silently sending identity-linked metadata is a privacy and trust problem, and the aquarium-analysis context makes this transmission harder to justify.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The _get_or_create_user flow posts identity data to an external phoneLogin endpoint with silent/register flags, effectively auto-registering or logging in a user. Doing this without prominent disclosure or consent is dangerous because it creates external accounts and propagates identity information for a purpose unrelated to the stated fish-monitoring behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

| 🔎 使用提醒 | **4 级告警策略递进**（none → important → urgent → critical），多鱼/全缸/持续超长进入更高级别 |
| 🔎 使用提醒 | 单日告警上限：Level 1 不限 / Level 2 × 4 / Level 3 × 6 / Level 4 **不设上限**（生命安全优先） |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **🚨 禁止**做"氨氮中毒确诊 / 亚硝酸盐中毒确诊 / 鳃病确诊 / 寄生虫确诊"等具体疾病诊断（仅可输出"视觉预兆/风险预警"语义） |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案（特别**严禁推荐硝化菌液具体品牌、解氨剂、亚甲基蓝等任何药剂**） |
| 🔎 使用提醒 | **禁止**长期存储完整鱼缸视频（≤ 7 天，仅入库浮头事件片段；公共水族馆/养殖场按管理规定） |
| 🔎 使用提醒 | **禁止**用于商业广告 / AI 训练；禁第三方共享 |

• Confidence: 78% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-fish-gasping-ammonia-warning-analysis"
description: "Through fixed aquarium cameras, the system analyzes fish behavior near the water surface, detecting repeated mouth-out-of-water (gasping), rapid mouth opening/closing (fast respiration) and exaggerated operculum (gill cover) movement — classic symptoms of hypoxia or poisoning. | 通过鱼缸固定摄像头，分析鱼类在水面附近的行为，检测鱼嘴反复探出水面（浮头）、张口快速开合（类似喘气）、鳃盖运动加剧等缺氧或中毒典型症状。当多条鱼同时出现上述行为且持续时间超过设定阈值（默认 60 秒）时，输出'氨氮中毒或缺氧风险预警'，提醒用户立即检测水质、换水或增氧。"
version: "1.0.9"
license: "MIT-0"
---

• Confidence: 82% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2