Frog Skin Moisture Assessment | 蛙类皮肤湿润度评估

• Outcome: Review
• Latest audit: Nov 13, 2026 · 7:40 AM UTC
• Version: 1.0.15

Overview

ClawScan marks this skill suspicious because scanners report account, credential, and network behavior beyond its stated frog image analysis purpose, along with risks around media uploads and user choices.

Consider avoiding installation until you understand why the skill handles persistent accounts and credentials, how it protects them, and where media and identity data are sent. The results are incomplete: Skillspector marked its analysis partial because a referenced local path was missing, and some findings apply only to supplied code. The suspicious verdict indicates reported risks, not proof that the author intended harm.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/smyx_frog_skin_moisture_assessment_analysis.py

Finding

CLI initialization discards upstream sender identity and selects a workspace-wide account

Content

View full analysis

Impact

In the stated deployment, another sender's --list request retrieves the reused account's reports. Analysis submissions are also associated with that account. This is a client-side account-selection vulnerability, not a demonstrated server authentication bypass.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (29)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk contains no camera capture, image processing, specular-reflection measurement, or moisture assessment. Database persistence could support the declared system, but this implementation specifically manages user identities, personal details, and tokens rather than frog images or analysis results. Those capabilities are not represented in the description. This finding concerns the supplied chunk; it does not establish what other skill files implement or imply that stored data is exfiltrated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk contains no camera capture, image processing, gloss measurement, or moisture assessment. Generic utilities and HTTP transport could support such a skill and are not independently grounds for a mismatch. However, the code also implements an undeclared persistent identity, remote registration, credential-management, and billing workflow. These are substantive capabilities beyond the stated frog-monitoring purpose. The assessment is limited to this chunk; the relevant behaviors occur when its utility methods are invoked, and the remote endpoints are defined in an unseen configuration module.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code does not implement the declared frog-monitoring capability. Its only substantive method is a generic chat wrapper whose execution path is disabled and broken. Commented-out subprocess commands are not active capabilities, and no external command execution is demonstrated. Imported base classes may provide additional behavior, but their implementations are not supplied, so they cannot establish that the declared functionality exists.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied chunk contains no camera capture, image processing, glossiness detection, or moisture assessment. Instead, it exposes generic network and account-related functionality not described in the declared purpose. HTTP helpers and image-download support could be legitimate implementation details, but this chunk establishes no such connection, and its broader CRUD and user-lookup capabilities are outside the stated scope. These are exposed methods; the chunk alone does not show them being invoked or establish malicious activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The supplied code contains no camera-capture logic or explicit frog-skin, reflection-intensity, or moisture-assessment operations. It primarily wraps an analysis service and provides report retrieval and export links. The unseen service could perform the declared visual assessment, so that cannot be ruled out; however, the supplied chunk does not establish that specialization and exposes an additional historical-report retrieval capability. File validation, API submission, and polling alone would be supporting implementation details rather than mismatches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The visible code implements a video-analysis and history-listing tool. It contains no camera-capture logic, frog-skin targeting, reflection measurement, or moisture assessment. Those specialized functions could exist in the imported skill implementation, which is not supplied, so their absence here does not conclusively establish that they are absent from the entire system. However, the supplied chunk exposes a generic video-analysis interface and an additional account-linked history capability that the description does not represent.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-frog-skin-moisture-assessment-analysis"
description: "Through fixed cameras in rainforest tanks or vivariums, the system captures high-definition images of the dorsal or lateral skin of frogs (such as tree frogs, horned frogs, dart frogs), and uses AI visual analysis to detect skin glossiness (specular reflection intensity) and assess skin moisture levels. | 通过雨林缸或饲养箱固定摄像头，拍摄蛙类（如树蛙、角蛙、箭毒蛙）的背部或侧身皮肤高清图像，利用 AI 视觉分析技术检测皮肤的光泽度（反光强度），评估皮肤的湿润程度。健康的蛙类皮肤应湿润、有光泽�

The HTTP helper can forward service credentials to arbitrary caller-supplied destinations.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The helper accepts absolute HTTP or HTTPS URLs and automatically attaches X-Access-Token, X-Api-Key, and Authorization without checking the destination origin. If an untrusted caller can influence a URL, credentials can be sent directly to an attacker-controlled server; HTTP also exposes them to network interception.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The analysis workflow does not warn users that local images or videos will be sent to a remote API service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

Although cloud APIs are mentioned elsewhere, the local-file workflow does not clearly explain that the actual image or video contents leave the device. Users could submit enclosure footage containing private surroundings or facility details without understanding that disclosure.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes image/video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser advertises an export-only flag that promises not to perform analysis, but the program never checks that flag. When supplied with media, execution still initializes identity and invokes analysis, potentially submitting data or incurring charges despite the user's explicit non-analysis selection.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are submitted to the analysis API without disclosure of the upload.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The function reads the complete local media file and passes its contents to the analysis service without any visible upload disclosure or authorization gate. Local vivarium footage can include private surroundings, so an analysis request can disclose more information than users expect.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The export-only option is parsed but never used to control execution. With an input file or URL, the command proceeds to identity initialization and analysis even though the option explicitly promises not to analyze, potentially causing unintended submission or billable activity.

Content

No source excerpt is available for this finding.

The service exposes general-purpose remote mutation capabilities unrelated to frog skin moisture assessment.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The http_put and http_delete methods forward caller-supplied URLs and arguments to the request utility, exposing remote modification and deletion capabilities. Although network requests can reasonably support image analysis, unrestricted remote mutation is not justified by the stated image-capture and moisture-assessment purpose.

Content

No source excerpt is available for this finding.

The service provides username-based user lookup outside the stated image-analysis purpose.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The get_user_by_username method delegates a caller-supplied username to a user-lookup utility. Looking up users is a separate account-management capability with no stated role in capturing frog images or assessing skin moisture; the supplied code shows no assessment-specific restriction on this capability.

Content

No source excerpt is available for this finding.

The skill includes user-profile and credential management unrelated to frog skin moisture assessment.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The User model stores personal information, including real names, email addresses, birthdays, and authentication tokens (L448–L465). UserDao exposes the inherited database read, update, and delete operations for these records (L470–L473), and DAO initialization creates and migrates the user table (L180–L215). This account-management capability is not justified by the manifest's camera-based skin glossiness and moisture analysis purpose.

Content

No source excerpt is available for this finding.

ai_chat documents subprocess-based AI analysis, but the agent invocation is disabled and no analysis result can be returned.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L25–L34 explicitly states that this method invokes the openclaw agent through subprocess and returns an analysis result or session ID. However, the subprocess invocation is commented out, and the replacement empty dictionary at L68 causes result.stderr to raise an exception that is caught without returning a result. The documented analysis delegation therefore does not occur.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive write mode.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The generically named open helper always opens the supplied path in 'w' mode, immediately erasing any existing contents. There is no docstring, comment, confirmation, or operation log explaining this behavior; exception tracing does not disclose successful truncation.

Content

No source excerpt is available for this finding.

The request helper silently registers remote accounts and persists user credentials, beyond the advertised frog-image assessment.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

An ordinary HTTP request can implicitly register a remote account using the current identity and persist returned profile information and bearer tokens locally. This introduces undisclosed identity transmission and credential retention beyond what a user would infer from frog-image assessment, without an explicit enrollment decision in this path.

Content

No source excerpt is available for this finding.

HTTP requests can silently trigger remote account registration and local credential persistence.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The request wrapper has hidden account-creation and credential-persistence side effects whenever cached authentication is missing. This is the same underlying issue as the SDI-1 finding: a request can disclose identity information and create durable credential state without explicit enrollment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The login POST silently transmits the selected identity as both openId and mobile, and that identity can be ApiEnum.API_SECRET_KEY because the caller prioritizes the secret over usernames. Consequently, an API secret can be placed into account-registration fields, potentially exposing it to profile storage and logging systems rather than limiting it to authentication handling.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Loading configuration silently creates directories and YAML files, including during module import.

Low

• Category: Output Handling
• Confidence: 92% confidence

Finding

YamlUtil.load creates a parent directory and writes a configuration file when the requested path does not exist, without any prompt, log, docstring, or explanatory comment disclosing this side effect. BaseEnum.init_subclass invokes this loader during class definition (L053 and L058), so importing the module can modify the filesystem without an explicit save request.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None