Security audit

Pet Grooming Effectiveness & Hairball Risk Analysis | 宠物梳毛器梳理效果与毛球风险

Security checks across malware telemetry and agentic risk

Overview

The skill’s grooming analysis purpose is real, but it also silently creates or reuses account identity, stores tokens locally, and sends media plus identity data to backend services without enough user-facing control.

Review carefully before installing. Use this only if you are comfortable with pet media or media URLs being sent to the configured backend, with a local workspace database being created, and with account identifiers/tokens being created, reused, and stored locally. Avoid using sensitive media or internal URLs unless the publisher documents the backend destination, retention, token handling, and cleanup controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 76% confidence
Finding: This method accepts arbitrary keys from the filters dictionary and passes them into getattr(self.__model__, key). While this is not classic SQL injection because SQLAlchemy still parameterizes values, untrusted callers can trigger unauthorized querying on unintended model attributes, bypass business rules, or cause exceptions/DoS by referencing invalid attributes. In this skill context, the shared DAO handles user records and token-bearing fields, so overly flexible filtering increases the chance of privacy-impacting access patterns.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 74% confidence
Finding: Like the list() method, count() builds filters from arbitrary dictionary keys without an allowlist. This can expose metadata about records through unauthorized counting of sensitive conditions and can also be abused to probe model structure or trigger runtime errors. Because this module stores user identity data, even record-existence leakage has some privacy significance.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill manifest describes capabilities to read/write local files, invoke shell commands, access environment data, and make network requests, but does not declare permissions or present clear user-consent boundaries. This creates a trust and review gap: a user or hosting platform may not realize the skill can persist uploaded content locally and send user-supplied URLs/files to backend services.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script exposes a `--list` mode that retrieves prior analysis history via `skill.get_output_analysis_list(open_id=open_id)`, but this capability is not reflected in the declared purpose of simple media analysis. Undisclosed access to historical user-scoped data expands the data surface and can enable privacy violations or unintended data enumeration if invoked by callers who only expected one-off image/video processing.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code silently resolves an internal `open_id` and then uses that identity to access user-scoped analysis data, even though the advertised function is just grooming media analysis. Binding hidden identity resolution to a narrow analysis workflow creates an unnecessary privacy and authorization risk, especially if callers are unaware that invoking the skill may touch account-linked records.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This module exposes generic add/edit/delete and arbitrary http_get/http_post/http_put/http_delete wrappers that are not constrained to the skill’s stated purpose of pet grooming media analysis. In a skill that accepts local files or network URLs and calls server-side APIs, this broad network capability increases the attack surface and could enable unintended access to unrelated internal or external endpoints if higher-level code passes user-influenced URLs or parameters.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is described as pet grooming image/video analysis, but this shared module persists and manages user-account records unrelated to that stated purpose. That is a data minimization and scope-creep problem: if invoked by this skill stack, it could collect or retain personal data beyond what users would reasonably expect for grooming analysis. The mismatch makes the behavior more suspicious, not less, because unrelated identity storage broadens privacy and compromise impact.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The User model stores identity and authentication-related fields including username, realname, email, token, and open_token without any demonstrated need for a grooming-effectiveness analyzer. Storing tokens in a local SQLite database materially increases the blast radius of local compromise and creates unnecessary credential exposure risk. In this skill context, that mismatch is especially concerning because users supplying pet media would not expect token persistence.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The utility creates and persists default local user identities for the skill framework, which exceeds the declared grooming-analysis purpose and introduces hidden identity state. In this context, silently generating user identities can enable tracking, cross-session correlation, and later authenticated API use without explicit user awareness or consent.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The HTTP helper implicitly performs remote registration/login by sending openId, mobile, and source values to a backend when tokens are absent, even though the skill is presented as a pet grooming image/video analysis tool. This hidden account bootstrap materially expands the data flow and trust boundary, allowing undisclosed identity creation and credential provisioning tied to user activity.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code inspects workspace/environment context and later uses it to locate data and credential-like files, capabilities not obviously necessary for simple grooming media analysis. In a skill ecosystem, this broadens access to local agent/workspace state and can expose unrelated filesystem context or secrets if reused elsewhere.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger rules are broad enough to activate on common grooming or pet-health related terms, including automatic history lookup behavior, which can cause the skill to run when the user did not clearly consent to file processing or cloud queries. Over-broad activation is dangerous here because the skill can save attachments locally and transmit URLs/files to server-side APIs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that local uploads and network URLs are supported and that server-side APIs are called, but it does not provide a prominent user warning that submitted media or remote URLs will be transmitted to external/cloud services. This is a privacy and data-handling risk because users may share pet photos/videos or internal URLs without understanding they will leave the local environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly says uploaded attachments or video/image files are automatically saved as local files, but it gives no user-facing warning about retention, storage location, cleanup, or access controls. Silent persistence of user media increases privacy exposure and can leave sensitive files on disk longer than expected.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The comment and implementation indicate hidden internal identity initialization without user-facing disclosure: `OpenIdUtil.resolve_current_open_id(...)` is called while `--open-id` is suppressed from help. Concealed identity handling is dangerous because it obscures collection and use of user identifiers, undermines informed consent, and can facilitate access to personal history or correlation of requests across sessions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code reads arbitrary local file contents into memory and sends them to a server-side analysis API, but this file contains no user-facing notice, consent check, or restriction beyond format and size validation. In a skill that handles local uploads and remote URLs, this creates a real privacy and data-handling risk because users may unintentionally transmit sensitive media or metadata off-device without clear disclosure.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The script accepts a hidden --api-key parameter and suppresses it from help output, which reduces transparency around credential use and network-backed behavior. Hidden credential-bearing parameters can enable undisclosed secret injection through wrappers or automation, increasing the risk of accidental exposure, misuse, or covert outbound access to backend services.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The --url option allows remote content to be analyzed without any user-facing warning that the content may be retrieved or processed by a backend service. In a skill that handles user-supplied media, this creates a data-handling transparency problem and can lead to unintended sharing of sensitive URLs or media with external systems.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The utility reads an internal identity value from data/smyx-api-key.txt and uses it as an open-id fallback without any visible disclosure or consent flow. This can silently repurpose local credential-like material for identity selection, potentially linking the user or workspace to remote requests in a way the declared skill purpose does not justify.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The request helper transmits identity and authentication data such as App-Id, X-Access-Token, X-Api-Key, Authorization, openId, mobile, and pnaUserName during network operations, but the code shows no user-facing notice or meaningful consent boundary. For a grooming-analysis skill, this hidden transmission is especially concerning because users would reasonably expect media analysis, not background identity propagation and tokenized account activity.

External Transmission

Medium

Category: Data Exfiltration
Content: "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"):
Confidence: 94% confidence
Finding: This outbound request sends registration/login data to an external service, including identifiers like openId and mobile, as part of hidden account creation logic. External transmission alone is not always a flaw, but here it is dangerous because it is unrelated to the skill’s stated grooming-analysis purpose and occurs implicitly without clear disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2