Back to skill

Security audit

Frog Skin Moisture Assessment | 蛙类皮肤湿润度评估

Security checks across malware telemetry and agentic risk

Overview

The skill is a cloud-backed frog moisture analysis tool, but it silently creates or reuses an identity, stores tokens locally, uploads media or URLs, and can retrieve cloud history, so it should be reviewed before installation.

Install only if you are comfortable sending frog images/videos or URLs to the configured LifeEmergence cloud services and having the skill create or reuse a local identity, store account tokens in a workspace SQLite database, and retrieve account-linked report history. Review retention, deletion, and account controls before using it with sensitive vivarium, veterinary, or business media.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (33)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The manifest presents a simple frog-image analysis skill, yet the documented behavior implies capabilities to read/write local files, invoke shell commands, access environment data, and perform network operations without declaring corresponding permissions. This creates a transparency and least-privilege problem: operators may authorize or trust the skill for narrow image analysis while it can access broader resources than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill description claims narrowly scoped frog skin moisture assessment, but the documented behavior expands into identity creation, token acquisition, cloud history retrieval, generic file/URL uploads, and report link exposure. This mismatch can conceal data collection and remote account interactions that users and reviewers would not reasonably expect from the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill is framed as camera-based image analysis, but also includes cloud historical-report retrieval and link-returning behavior not implied by the core description. That broadens data flow from local analysis to remote record access, increasing privacy and data exposure risk if users do not realize the skill accesses prior reports.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
Automatically saving uploaded files locally and requiring cloud API access for history queries goes beyond a purely visual assessment workflow. These behaviors introduce local data retention and remote transmission risks, especially for media files, without strong justification or clear scoping in the user-facing purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Automatic reuse or creation of a default local identity is unrelated to frog skin analysis and creates hidden state linking actions across sessions. This can enable silent user tracking, cross-session data association, and unintended access to prior reports or tokens under a persistent identity the user never explicitly approved.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Mandatory acquisition and use of an internal open-id is context-inappropriate for a frog image analysis skill and indicates hidden authentication/account coupling. This can silently bind user activity to backend identities and enable unauthorized data retrieval or correlation beyond the expected analysis task.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill includes a history-listing function tied to an internal user identity even though the stated purpose is frog skin moisture assessment. Mixing identity-scoped record retrieval into a simple analysis tool expands data exposure and can enable unauthorized access to prior analyses if identity resolution or access controls are weak.

Description-Behavior Mismatch

Low
Confidence
77% confidence
Finding
Accepting arbitrary remote URLs broadens the input surface beyond the fixed-camera/local-capture use case described by the skill. If downstream processing fetches the URL server-side, this can become an SSRF-style vector or allow ingestion of untrusted remote content inconsistent with the intended deployment model.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code resolves an internal open_id even when performing ordinary media analysis, which introduces identity coupling unrelated to the core frog skin assessment task. This creates unnecessary collection and use of user-linked metadata and increases the chance of privacy violations or cross-user data access if the identity is reused for record lookup.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The implementation accepts generic video inputs and remote video sources, while the stated skill purpose is fixed-camera frog skin image assessment. This scope expansion increases the chance the skill is used on unintended data types or surveillance-style footage, creating data handling and misuse risks beyond the declared functionality.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code accepts arbitrary http/https URLs and forwards them as analysis targets without any hostname allowlist, scheme hardening, or purpose limitation. In a fixed-camera vivarium assessment skill, this unjustified remote-fetch capability can be abused to analyze unrelated third-party content or trigger backend network access patterns inconsistent with the advertised function.

Description-Behavior Mismatch

High
Confidence
90% confidence
Finding
The implementation exposes a generic video-analysis flow and delegates analysis to a broad skill backend, while the manifest claims a narrowly scoped frog skin moisture image assessment capability. This scope mismatch is dangerous because users, orchestrators, or policy systems may grant the skill access or trust under false assumptions, enabling unintended processing of arbitrary media and expanding the attack surface beyond the declared purpose.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The history-listing capability tied to an open_id introduces user/history access that is not described by the skill's stated animal-moisture assessment function. Undeclared retrieval features can expose prior analysis metadata or results to contexts that only expected single-purpose image assessment, creating privacy and authorization risk if access controls are weak or assumptions are incorrect.

Intent-Code Divergence

High
Confidence
92% confidence
Finding
The code and interface repeatedly describe video analysis, local MP4 input, and video URL handling, which materially contradicts the manifest's image-based frog skin moisture assessment description. This discrepancy increases the chance of policy bypass, overbroad permissions, and unsafe deployment because reviewers and automated systems may approve a low-risk zoological image tool while actually receiving a generic media-analysis utility.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes a broad, generic HTTP client surface including arbitrary POST, PUT, GET, and DELETE wrappers plus generic CRUD helpers that accept caller-supplied URLs and arguments. In a skill whose stated purpose is frog skin moisture assessment from images, this capability is unnecessarily expansive and could be abused by other parts of the skill to reach unrelated internal or external services, increasing SSRF-like and unauthorized data-access risk if untrusted input can influence the target URL or request data.

Context-Inappropriate Capability

Low
Confidence
85% confidence
Finding
The user lookup helper is unrelated to image-based frog moisture analysis and expands the skill's ability to access identity-related information. Even if harmless in isolation, unrelated account-enumeration or user-resolution functionality increases the attack surface and may enable privacy issues or misuse when included in a domain-specific skill that should not need identity lookup features.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This frog skin moisture assessment skill ships DAO/model code for managing local user records, including identity and account-like data, which is unrelated to camera-based amphibian image analysis. The mismatch indicates unnecessary access to user/account storage and increases the blast radius if the skill is invoked or integrated in broader agent workflows.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The User model stores authentication-like tokens and personal profile fields such as real name, email, birthday, and age without any apparent need for frog skin moisture analysis. Retaining this sensitive data in a local SQLite database creates unnecessary privacy and credential exposure risk, especially in a shared workspace data directory.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The DAO exposes broad create, update, modify, save, delete, and count operations that exceed the stated purpose of passive frog image moisture assessment. Such generic mutation capability enables unintended tampering with local records and increases the chance that the skill is repurposed to manage unrelated data or state.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs remote account provisioning, login, token acquisition, and token persistence that are unrelated to frog skin moisture image assessment. This creates hidden identity and network behavior: merely using the skill can authenticate against external services, mint or reuse accounts, and send identifiers/tokens off-device without a clear user need tied to the stated function.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This code resolves identity by reading a workspace key file, reusing stored usernames, or silently creating persistent default user records. For a camera-based frog skin analysis skill, that identity lifecycle is out of scope and dangerous because it establishes durable user identities without informed consent and can later be used for tracking, billing, or remote service access.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The default trigger is broad enough to activate on essentially any frog image or video presented for analysis, even when the user did not request this specific skill. Over-broad invocation increases the chance of unintended file handling, uploads, persistence, or account-linked processing of user media.

Vague Triggers

Medium
Confidence
80% confidence
Finding
Broad history-query keywords can auto-trigger remote retrieval of historical reports with little contextual limitation. In combination with hidden identity handling, this raises the risk of exposing account-linked report metadata or links when a user did not intend a cloud lookup.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2