Fish Surface Symptom (White-spot / Hyperemia / Fin-rot) Detection | 鱼类体表白点/充血/烂尾识别

• Outcome: Review
• Latest audit: Aug 29, 2026 · 12:52 PM UTC
• Version: 1.0.10

Overview

This fish-analysis skill is not clearly malicious, but it needs Review because it silently manages identity, stores tokens locally, and is configured to use private development HTTP endpoints.

Install only after reviewing the publisher and data handling. Expect fish media or URLs, report requests, and identity fields to be sent to backend services, and expect local token storage. The dev/private HTTP endpoint configuration should be fixed or explained before normal users install it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to use shell commands, local file handling, network access, and identity-related configuration, but it declares no permissions or capability boundaries. This mismatch can cause the hosting system to grant or exercise sensitive capabilities without transparent review, increasing the risk of unintended file access, network calls, or execution in response to user prompts.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script exposes a history-listing feature tied to an internal user identity even though the advertised purpose is fish symptom detection on media inputs. This expands the skill from single-item analysis into access to prior records, creating unnecessary data exposure risk and enabling unauthorized viewing of historical analyses if identity handling is weak elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code resolves and uses an internal open_id despite the skill's stated purpose not requiring user identity to analyze a fish image or video. Collecting or deriving identity without necessity increases privacy risk, can link uploaded media to user accounts, and may enable cross-user data access if the identity source is manipulable.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill accepts arbitrary http/https URLs and forwards them for analysis, which expands behavior beyond the declared local camera/image-analysis use case. This can enable misuse of the backend as a fetch/proxy mechanism against attacker-chosen remote content, potentially exposing internal services or causing analysis of unintended third-party resources depending on how the downstream API retrieves URLs.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The script behavior does not match the declared skill purpose of fish body-surface symptom detection. Instead, it acts as a generic video-analysis client and can process arbitrary local paths or URLs, which creates a scope-expansion risk where users may unknowingly send unrelated media to backend services. In a security review, this kind of capability mismatch is dangerous because it weakens informed consent and can hide broader data collection or processing than the manifest suggests.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The history-listing capability exposes or retrieves prior analysis records via an open_id, but that functionality is not justified by the stated fish-symptom detection use case. Extra data-access features increase privacy risk, especially if history can reveal prior uploads, identifiers, timestamps, or analysis content beyond the user's expectation. In this context, the mismatch makes the feature more suspicious because it adds user-data retrieval unrelated to simple symptom detection.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file exposes generic CRUD helpers and arbitrary HTTP methods that can be used to call remote endpoints unrelated to the declared fish-symptom analysis purpose. In a skill whose manifest describes narrow image-analysis functionality, this broad network capability materially expands the attack surface and could enable data exfiltration, unauthorized remote actions, or misuse of the hosting agent as a proxy.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The generic http_post/http_put/http_get/http_delete wrappers permit arbitrary outbound network access through a reusable helper with no visible restrictions on destination, payload, or purpose. For a skill advertised as local fish disease image analysis, this mismatch is suspicious because it enables silent transmission of user, image, or environment data to external systems.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The get_user_by_username function introduces user-account lookup behavior that is unrelated to aquarium fish symptom detection. Unnecessary identity-query functionality increases privacy risk and suggests the skill can access or enumerate user information beyond its stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: This module persists user identities and authentication-related fields such as token and open_token, which are unrelated to the advertised fish-symptom vision-analysis capability. Hidden account/token storage broadens the data-handling surface and creates unnecessary exposure if these values are stored insecurely, reused across skills, or accessed by components that users would not expect.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The file implements a broad reusable DAO layer with schema creation, schema mutation, arbitrary CRUD, and shared database path redirection, which significantly exceeds the narrow function described in the skill metadata. In a skill expected to perform image-based fish disease detection, undisclosed general-purpose persistence increases attack surface, complicates review, and could facilitate storage or manipulation of unrelated data without clear user awareness.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This shared utility silently performs account lookup, token recovery, remote login/registration, and token persistence before ordinary HTTP requests. Those behaviors are unrelated to fish-symptom vision analysis and materially expand the skill's privileges and data flows, creating unauthorized identity provisioning and backend access risk if invoked in a user session.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code generates synthetic `User_xxxxxx` identities, searches local storage for reusable identities, and persists them for future API use. For a fish disease detection skill, creating and reusing hidden identities is unjustified and can enable impersonation-like behavior, unauthorized account creation, and opaque tracking across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The utility inspects agent workspace structure, environment variables, and creates agent-scoped data/skills directories. While not directly exploitable alone, this broad filesystem/environment awareness exceeds the declared image-analysis purpose and enables collection of workspace metadata plus preparation for writing files in agent contexts.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger is broad enough to activate on nearly any fish image or video analysis request, even when the user did not clearly ask for this specific skill. Over-broad auto-invocation can cause unintended processing of files or URLs and may chain into script execution or remote API use without sufficiently specific consent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The historical report query trigger automatically activates on a wide set of natural-language phrases and then mandates a cloud API lookup. Because these queries are tied to internally managed identity and tank-linked reports, broad triggering increases the chance of unintended retrieval of potentially sensitive historical records.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script initializes an internal user identity silently and suppresses the related CLI option from help, so users are not informed that identity handling is occurring. Hidden identity processing undermines transparency and consent, and in a data-processing tool this can mask account linkage or record access behavior from operators.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The code reads the full local file into memory and transmits it to an external analysis service without any in-file user notice, consent flow, or minimization controls. In a media-analysis skill, this creates privacy and data-handling risk because users may unknowingly send sensitive images/videos or metadata off-device.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script accepts hidden credential-related parameters such as --open-id and --api-key while suppressing them from normal help output. Hidden auth-related inputs reduce transparency and can conceal sensitive behaviors, making it harder for users and reviewers to understand how identities and credentials are being supplied or used. In a skill that already shows scope mismatch, concealed parameters increase the risk of undisclosed account targeting or backend access patterns.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code reads `data/smyx-api-key.txt` to obtain an identity value without explicit disclosure, consent, or validation of necessity. Silent consumption of credential-like local files can surprise users, bypass intended authentication UX, and leak or misuse sensitive account context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The utility automatically transmits identity-related fields such as `openId`, `mobile`, `source`, and username-derived values to remote services without clear user-facing disclosure. In the context of a fish-symptom detection skill, this is unnecessary data sharing and creates privacy, consent, and account-linkage risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: This outbound POST sends identity-bearing registration/login data to an external endpoint. External transmission is expected for some cloud skills, but here the transmitted account data is unrelated to the advertised fish-image analysis function and occurs automatically, making the behavior risky and privacy-invasive.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-fish-surface-symptom-detection-analysis"
description: "Through fixed cameras on aquariums or underwater cameras capturing high-definition fish images, the system uses AI vision analysis to detect abnormal symptoms on the fish body surface: white-spot disease (white spots of about 0.5-1mm in diameter, salt-grain like), hyperemia (red blood streaks or patches on skin or fin bases), and fin-rot (tail-fin edges turning white, ragged or rotting). | 通过鱼缸固定摄像头或水下摄像头拍摄鱼类高清图像，利用 AI 视觉分析技术检测鱼体表面的异常症状：白点病（白色点状物，直径约 0.5-1mm，类似盐粒）、充血（皮肤或鳍条基部出现红色血丝或斑块）、烂尾（尾鳍边缘发白、残缺、腐烂）。该技能有助于早期发现观赏鱼常见疾病，指导用户采取隔离、升温、用药（用药请咨询专业水族兽医）等措施。"
version: "1.0.12"
license: "MIT-0"
---

• Confidence: 82% confidence
• Finding: The manifest shows metadata-poisoning indicators, including unusual hidden characters and instruction-dense descriptive metadata. Even if not overtly malicious, poisoning-like metadata can influence tool routing, reviewer interpretation, or downstream agent behavior in ways that are hard to audit, especially when combined with broad triggers and implicit capability use.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2