Security audit
Security checks for vulnerabilities and agentic risk
This skill sends fish media and account-linked identifiers to a cloud service and persists tokens locally, so it should be reviewed before installation.
Install only if you are comfortable with fish images/videos or media URLs being processed by the configured cloud service, a silent account/open-id being created or reused, and tokens being stored in a shared workspace SQLite database. Avoid using it with sensitive media or in sensitive workspaces unless the publisher documents retention, account linkage, and endpoint scope more clearly.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The gap between the benign fish-health description and the broad underlying behaviors—external HTTP communication, token/identity management, local file and directory reads/writes, and workspace detection—creates a significant trust and data-handling vulnerability. Users may provide images believing they are using a simple analyzer while the skill can inspect workspace context and maintain identity-linked state.
The metadata-poisoning indicator is weaker than the purpose-mismatch findings, but suspicious manifest formatting or hidden characters in metadata can be used to confuse parsers, reviewers, or policy tooling. In combination with the broader description/behavior mismatch, anomalous metadata should be treated as increasing risk rather than dismissed as harmless.
---
name: "smyx-fish-surface-symptom-detection-analysis"
description: "Through fixed cameras on aquariums or underwater cameras capturing high-definition fish images, the system uses AI vision analysis to detect abnormal symptoms on the fish body surface: white-spot disease (white spots of about 0.5-1mm in diameter, salt-grain like), hyperemia (red blood streaks or patches on skin or fin bases), and fin-rot (tail-fin edges turning white, ragged or rotting). | 通过鱼缸固定摄像头或水下摄像头拍摄鱼类高清图像，利用 AI 视觉分析技术检测鱼体表面的异常症状：白点病（白色点状物，直径约 0.5-1mm，类似�
This file exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the fish-symptom detection purpose described in the manifest. In an agent-skill context, these helpers can be reused to reach unrelated endpoints or perform unauthorized remote actions, significantly expanding capability beyond the declared scope and increasing abuse potential.
The http_post/http_put/http_get/http_delete methods accept caller-controlled URLs and forward requests directly, creating arbitrary outbound network capability. For a fish disease detection skill, this is unjustified and dangerous because it could enable SSRF-like behavior, data exfiltration, probing internal services, or invoking attacker-chosen APIs if exposed through higher-level tool use.
This file implements a generic user-account DAO and default-user selection logic, which is unrelated to the manifest's claimed fish surface symptom detection capability. Purpose mismatch is a serious security concern because it suggests hidden data collection or cross-skill account persistence beyond user expectations, especially when combined with shared workspace database behavior.
The User model stores identity, contact, and authentication-related data including username, realname, email, token, and open_token, which are not justified by a fish-disease image analysis function. Collecting and updating such data creates unnecessary privacy and credential-handling risk, and if compromised could expose personal information or reusable authentication artifacts.
This utility code performs identity resolution, reads local workspace identity material, creates default user identifiers, and persists account state, which is unrelated to the declared fish disease image-analysis purpose. Such hidden account-provisioning behavior expands the skill's access and allows silent collection or creation of identities without clear user consent, making the mismatch between claimed purpose and actual behavior security-significant.
The generic HTTP wrapper supports broad outbound API access, automatic token handling, auto-registration/login, and user-context injection, none of which are justified by a fish-surface symptom detection skill description. This creates a hidden data exfiltration and remote-action surface that could transmit local identity and workspace-derived information to external services under the guise of benign image analysis.
The general request wrapper automatically attaches tokens, API keys, authorization headers, tenant/platform metadata, and user identifiers to outbound requests without clear user awareness. In the context of a narrowly described aquarium disease-detection skill, this hidden broad transmission behavior materially increases the risk of credential leakage, unauthorized backend access, and cross-service tracking.
The helper silently sends openId, mobile, and source data to a remote /sys/phoneLogin endpoint with register=1, meaning it can both identify and auto-register users without an explicit notice or opt-in. Hidden transmission of identifiers is especially dangerous because it can create remote accounts, link local identities to external services, and surprise users who only expected fish-image analysis.
The skill declares no explicit tool scope or permissions despite documenting behaviors that require shell execution, local file access, network access, and handling of implicit identity state. This creates an over-privileged and under-specified execution surface, making it easier for the skill to access resources beyond what a fish-image analysis workflow should need.
The default trigger is broad enough that routine image-analysis requests involving fish imagery or URLs/files could invoke this skill automatically. Over-broad activation increases the chance of unintended file handling, network transmission, or identity-linked processing without sufficiently specific user intent.
Automatic cloud history querying and implicit user identity handling go beyond the core purpose of one-off fish-image analysis and create additional privacy and access-control risk. The danger is heightened because the skill emphasizes that identity is handled silently, reducing user visibility into what records are being correlated or fetched.
The history-report trigger phrases are expansive and can activate record retrieval on loosely related user requests. This can expose account-linked historical data more readily than users expect, especially because the skill is designed to handle identity internally and query the cloud automatically.
The string returned on L17 is a user-facing heading entirely in Chinese, which imposes a specific language/locale without any visible opt-in or documented regional constraint in this file. The policy for natural-language content requires either user choice or a clearly justified locale restriction.
Detected: suspicious.install_untrusted_source