gait test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.5

Overview

The skill performs the advertised cloud pet-gait analysis, but it also silently creates or reuses service identities and persists authentication tokens locally.

Review this skill before installing if you do not want pet videos, report history, or identity-linked activity sent to Life Emergence cloud services. Avoid installing it in a workspace where other skills or users can read the shared data directory unless token storage and credential routing are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/util.py:568
• Finding: Authentication Credentials Can Be Forwarded to Arbitrary Network Destinations## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:568-608, 642` **Vulnerability Type**: Missing destination validation when attaching authentication credentials **Risk Level**: High ### Vulnerable Code ```python if not url.startswith("https://") and not url.startswith("http://"): url = cls.BASE_URL + url headers['App-Id'] = ConstantEnum.APP__ID if not (ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID): OpenIdUtil.resolve_current_open_id(use_current=False) current__user_name = ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) except Exception as e: CommonUtil.trace_exception_stack(e) raise headers.setd ...[truncated 2682 chars]
• Remediation: ## Remediation Suggestions 1. Reject absolute URLs in authenticated request helpers and accept only relative API paths. 2. Resolve paths against one fixed HTTPS base URL using a safe URL-joining implementation. 3. If absolute URLs are operationally necessary, enforce an exact allowlist of approved schemes, hostnames, and ports after canonical URL parsing. 4. Attach authentication headers only when the final normalized destination exactly matches the trusted API origin. 5. Reject `http://` for every request carrying credentials or sensitive user data. 6. Disable cross-origin redirects or remove authentication headers whenever a redirect changes origin. 7. Separate authenticated first-party requests from generic unauthenticated network requests into distinct APIs. 8. Add tests covering attacker-controlled absolute URLs, encoded hostnames, user-info URL syntax, alternate ports, subdomain confusion, and cross-origin redirects. 9. Rotate potentially exposed credentials after deploying the fix.

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/util.py:582
• Finding: Reusable Authentication Tokens Are Stored Unencrypted in a Shared SQLite Database## Vulnerability Details **File Location**: `skills/smyx_common/scripts/util.py:582-600`; `skills/smyx_common/scripts/dao.py:460-461` **Vulnerability Type**: Plaintext storage of sensitive authentication material **Risk Level**: Medium ### Vulnerable Code Token persistence in `skills/smyx_common/scripts/util.py`: ```python if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` Plaintext model fields in `skills/smyx_common/scripts/dao.py`: ```python token = Column(String(500), comment="token") open_token = Column(String(1000), comment="开放token") ``` ### Technical Analysis Tokens returned by the remote login service are copied into a user model and persisted directly in ordinary SQLite string columns. No application-level encryption, operating-system credential store, keyring integration, hashing, or restrictive file-permission enforcement is shown. Hashing is not suitable where tokens must later be replayed, but encryption backed by a protected key or avoiding persistent storage would reduce exposure. The database path logic intentionally places the database in the workspace-wide `data` directory, making it shared state rather than isolated Skill-private state. Anyon ...[truncated 1331 chars]
• Remediation: ## Remediation Suggestions 1. Avoid persisting reusable access and authorization tokens unless cross-session persistence is essential. 2. Prefer short-lived, narrowly scoped credentials and refresh them through a protected authentication flow. 3. Store necessary credentials in an operating-system keyring or secret-management facility rather than ordinary SQLite columns. 4. If database storage is unavoidable, encrypt token values using authenticated encryption with a key stored separately from the database. 5. Create the database with owner-only permissions and verify permissions before reading or writing credentials. 6. Isolate credentials by Skill and user instead of placing them in broadly shared workspace storage. 7. Never print, serialize, export, or include stored tokens in exception messages. 8. Add explicit token expiration, revocation, and rotation handling. 9. Remove previously persisted plaintext tokens and revoke or rotate existing credentials after migration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes reading local workspace files, manipulating agent directories, creating or reusing identities, accessing local databases, and performing authenticated remote login/registration. In the context of a seemingly harmless pet gait-analysis skill, these hidden identity and filesystem operations are especially dangerous because they exceed user expectations and could expose tokens, local data, or account state.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-gait-analysis-lameness-analysis"
description: "Triggers when a user provides a pet side-view walking video URL or file for analysis; uses AI pose estimation to track limb joint trajectories, analyzes stride length, stance phase / swing phase duration, and left-right symmetry indicators, and identifies abnormal gait such as lameness or restricted joint mobility. Helps early detection of orthopedic conditions (arthritis, hip dysplasia, ligament injury) in pets. Application: home daily health monitoring, senior pet arthritis screening, vet clinic initial assessment, post-op rehab tracking. Does NOT provide medical diagnosis —

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains identity resolution, default user creation, workspace credential reading, and authentication state management that are unrelated to the declared pet gait-analysis function. In a skill that should only analyze uploaded pet videos, these hidden identity and account-management behaviors materially expand data access and create undisclosed account linkage and persistence risks.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The HTTP helper does far more than send application requests: it auto-resolves identities, retrieves local tokens, performs remote login/registration, persists tokens, and retries authorization. That behavior is outside the stated scope of vision-based gait analysis and creates a hidden channel for account creation, identity transmission, and long-lived credential handling.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code automatically calls an external health-service phoneLogin endpoint with registration enabled, using a derived username/openId/mobile value. For a gait-analysis skill, silent auto-registration or login to a remote service is unrelated to the declared function and can create unauthorized accounts, transmit identifiers, and bind user activity to an external platform.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The helper transmits identity and registration-related fields (openId, mobile, source, register flag) to a remote endpoint without any user-facing disclosure. This creates a privacy and trust violation, especially given the mismatch between the declared pet gait-analysis purpose and the hidden account-enrollment behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises behaviors that require powerful capabilities such as shell, network, file read/write, and environment access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing least-privilege declarations increases the chance the skill can access more resources than users or reviewers expect, especially since the workflow directs shell execution and cloud API access.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The AI role is written as a direct instruction in Chinese and does not indicate that the assistant should adapt to the user's preferred language. This can violate language/locale policy because it imposes a specific language without explicit opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow states that uploaded attachments or media files are automatically saved locally, but it does not clearly warn users about storage, retention, or access controls. In a health-adjacent context involving user-provided pet videos and possible account linkage, undisclosed local persistence raises privacy risk and can leave sensitive media exposed in the agent workspace.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The returned user-facing string is entirely in Chinese ("宠物步态分析（跛行/关节炎）结构化结果"), which indicates a fixed language choice in the skill's output. There is no indication in this file that the user can choose the language or that the locale restriction is documented and justified.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill exposes a hidden report-history feature via the undocumented `--list` path, which is outside the manifest's stated purpose of analyzing a provided video. Hidden capabilities that enumerate prior reports can disclose sensitive pet-health and usage history, especially when combined with internal identity resolution.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code initializes and uses an internal user identity (`OpenIdUtil.resolve_current_open_id` and `ConstantEnum.CURRENT__OPEN_ID`) to retrieve stored analysis history, which is not necessary for one-off gait analysis. This creates a privacy and authorization risk because identity-linked historical data may be accessed without clear disclosure or proof of user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Hidden identity resolution occurs without visible user-facing disclosure because `--open-id` is suppressed from help while `resolve_current_open_id` is still invoked. Undisclosed collection or derivation of identity for accessing stored records is a privacy-sensitive behavior and can enable unauthorized correlation of health-related activity.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Multiple user-visible strings in this skill are hard-coded in Chinese, such as the analysis report heading and export-link text. The file does not provide any locale selection, fallback, or documentation justifying a Chinese-only experience, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Error and validation messages such as file-not-found, permission, unsupported-format, size-limit, and missing-input notices are presented only in Chinese. Because the skill does not offer a language choice or clearly document a region-specific restriction, these hard-coded locale assumptions are a policy concern.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2