Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches frog media analysis, but it silently creates or reuses a persistent identity, stores authentication tokens locally, and sends media/report requests to a cloud service without tight user-facing controls.
Install only if you are comfortable with frog images/videos or URLs being processed by the LifeEmergence cloud service and with the skill silently creating or reusing a local identity. Review the workspace `data` directory after use, protect or remove cached tokens if no longer needed, and avoid using sensitive media unless cloud retention and account controls are acceptable.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
External service communication, authentication/token management, user creation/lookup, local credential-like file access, and workspace-aware filesystem handling are far broader than the stated image-analysis purpose. In combination, these behaviors can expose secrets, create accounts, and move user data across trust boundaries without adequate disclosure or narrowly tailored authorization.
The YARA hit for MCP/tool metadata poisoning indicators is concerning in this context because the manifest already shows strong signs of capability misrepresentation and hidden behavior breadth. Even if the exact marker is partly heuristic, suspicious manifest metadata can be used to influence tool interpretation, evade reviewer expectations, or smuggle adversarial instructions through descriptive fields.
---
name: "smyx-frog-skin-moisture-assessment-analysis"
description: "Through fixed cameras in rainforest tanks or vivariums, the system captures high-definition images of the dorsal or lateral skin of frogs (such as tree frogs, horned frogs, dart frogs), and uses AI visual analysis to detect skin glossiness (specular reflection intensity) and assess skin moisture levels. | 通过雨林缸或饲养箱固定摄像头，拍摄蛙类（如树蛙、角蛙、箭毒蛙）的背部或侧身皮肤高清图像，利用 AI 视觉分析技术检测皮肤的光泽度（反光强度），评估皮肤的湿润程度。健康的蛙类皮肤应湿润、有光泽�
The manifest frames the skill as analyzing high-definition images of frog dorsal/lateral skin from fixed cameras. However, the code explicitly requires a local video path or network video URL and sends it as videoUrl, which is a materially broader and different input modality than the declared image-analysis scope.
The manifest describes analysis of high-definition frog skin images for glossiness/moisture assessment. In contrast, the code defines analyze_video, accepts --input as a local MP4 path or --url as a video URL, describes itself as a '视频分析工具', and supports listing prior video analyses. This is a clear semantic mismatch in the skill's stated modality and behavior.
This file exposes generic CRUD-style methods and arbitrary HTTP wrappers (http_get, http_post, http_put, http_delete) that are not constrained to the manifest’s stated purpose of frog skin moisture image analysis. In an agent-skill context, this expands the skill into a general remote action surface that could be abused to access, modify, or delete external resources unrelated to the declared function, especially if higher-level prompts or inputs can influence the target URLs or payloads.
The skill includes unrestricted remote resource manipulation capabilities through methods like add, edit, delete, and direct HTTP verb wrappers, without any visible limitation tying them to vivarium image processing. Because the declared skill is analytical rather than administrative, these capabilities are suspiciously overpowered and could enable unauthorized external state changes if an attacker can steer arguments, URLs, or request bodies.
The file implements generic user-account persistence, lookup, and default-user selection, which does not align with a frog skin moisture image-analysis skill. Such scope mismatch is dangerous because unrelated identity-handling code increases attack surface, enables unexpected data collection, and may indicate hidden multi-purpose behavior not disclosed by the skill manifest.
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, none of which are justified by the frog moisture assessment purpose. Unnecessary storage of credential-like data raises privacy and security risk, especially if this code is reused in contexts where those values come from users or external systems.
The code reads an identity value from workspace files, falls back to a local database, and creates a persistent default user if none exists. For a frog-image moisture assessment skill, persistent identity recovery and creation is unnecessary and dangerous because it silently establishes durable user linkage and state without a purpose tied to the declared functionality.
This utility code performs account provisioning, token retrieval, token caching, and authenticated API setup that are unrelated to frog skin moisture image analysis. In the context of a narrowly scoped animal-health imaging skill, hidden identity bootstrap and account lifecycle behavior materially expands the privilege and data-handling surface, enabling undisclosed remote access and persistence beyond the declared purpose.
The skill advertises broad operational behavior that implies shell, filesystem, environment, and network access, but it does not declare any explicit tool scope or permission boundaries. In an agent framework, this increases the chance that the skill can invoke high-risk capabilities implicitly, making review, sandboxing, and least-privilege enforcement difficult.
The skill description does not clearly warn users that uploaded files, URLs, and report queries are transmitted to cloud/API services. This undermines informed consent and can lead users to expose sensitive media, metadata, or history information without understanding that third-party processing and storage are involved.
The default trigger is broad enough to auto-invoke on general frog image or video analysis requests, which increases the chance of unintended uploads or execution without sufficiently specific user intent. Overbroad triggers are risky in agent systems because they can silently route data into remote processing paths or high-privilege workflows unexpectedly.
The script exposes a history-listing feature tied to an internal user identity even though the declared skill purpose is only frog skin moisture assessment from images/video. This creates an unnecessary data-access surface and may allow users to enumerate or retrieve prior analysis results that are outside the expected function of the skill.
This code file contains user-facing natural-language strings for the argument parser and runtime messages entirely in Chinese. The file does not offer any language or locale selection, which creates a locale policy issue under the rule for forced language without user opt-in.
Detected: suspicious.install_untrusted_source