Back to skill

Security audit

Pet Body Condition & Health Analysis Skill | 宠物体态健康分析技能

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches pet media analysis, but it silently creates or reuses account identity, stores tokens locally, and ships with configuration that can send data over non-HTTPS development endpoints.

Review this skill before installing. It sends pet media and account-linked identifiers to remote services, can create or reuse a backend identity, stores tokens in a local SQLite database, and the packaged configuration points to HTTP development endpoints despite HTTPS privacy claims.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to execute local Python scripts, save uploaded files locally, access configuration, and call remote APIs, yet it declares no explicit permissions or trust boundaries. This mismatch can cause the agent or platform to grant broader capabilities than users expect, increasing the risk of unintended file access, shell execution, and data transmission.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill exposes a history/listing capability via `show_analyze_list()` that is not reflected in the stated purpose of single-item pet body health analysis. Undeclared data-access features increase the attack surface and can enable unauthorized access to prior analysis records if the backing API does not strictly enforce per-user authorization.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code initializes internal OpenID-based identity handling even though the skill’s stated function is media health analysis, not account or identity processing. Hidden identity resolution can collect or bind user identity without clear necessity or transparency, creating privacy risk and enabling unintended access to user-scoped backend data such as analysis history.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill forwards attacker-controlled http/https URLs to the downstream analysis service without allowlisting, ownership checks, or disclosure of what network retrievals will occur. This can enable server-side fetching of arbitrary remote content by the backend service, expanding the skill beyond pet-health analysis and potentially exposing internal-service reachability, unexpected data access, or misuse of backend network capabilities.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially diverges from the declared pet body health analysis purpose and instead exposes a generic video-analysis wrapper plus history-listing functionality. Scope mismatch is dangerous because it can conceal broader data-processing behavior than users expect, undermining informed consent and allowing repurposing for arbitrary media analysis.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Accepting arbitrary remote URLs lets the backend fetch and analyze attacker-controlled resources, which broadens the skill beyond its stated purpose and can enable misuse such as processing unrelated third-party content. In skills handling user media, unrestricted URL ingestion also increases privacy, abuse, and potential backend request-surface risks depending on downstream implementation.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The history-listing capability by open_id is unrelated to the advertised pet body health analysis function and exposes access to prior analysis records. If open_id resolution or authorization is weak elsewhere, this creates an unnecessary data-access surface that could reveal other users' analysis history or metadata.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The CLI/help text presents the tool as generic video analysis, directly contradicting the manifest's pet-health-specific description. Deceptive or inconsistent UX is security-relevant because users may unknowingly submit broader content types or fail to understand what the skill actually does with their data.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file exposes generic http_post/http_put/http_get/http_delete wrappers that allow arbitrary outbound API interaction unrelated to the declared pet body health analysis purpose. In a skill context, this broad network capability materially expands what the component can do if other code passes attacker-controlled URLs, parameters, or payloads, enabling unauthorized data exfiltration or side-effecting remote actions.

Description-Behavior Mismatch

High
Confidence
91% confidence
Finding
The CRUD-style page/list/add/edit/delete helpers create a reusable administrative API surface that is much broader than image-based pet health assessment. That mismatch is dangerous because it provides generic state-changing operations that can be repurposed by the skill or adjacent code to manipulate remote resources with little contextual restriction.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The delete() method provides direct remote deletion capability without any visible constraint on target endpoint or resource type. For a pet health analysis skill, destructive remote operations are unjustified and could be abused to delete backend data or invoke destructive APIs if reachable from other components.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The get_user_by_username() helper introduces account lookup functionality unrelated to pet body health analysis. Unnecessary user enumeration primitives increase privacy risk and may support reconnaissance against backend identity systems if exposed through higher-level skill flows.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
A pet body health analysis skill containing a generic user/account persistence layer is a strong capability mismatch. Unrelated identity storage broadens the attack surface, enables collection of personal data beyond the declared purpose, and makes hidden secondary use of data more plausible in a skill that should primarily process pet-health inputs.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The model stores token and open_token values even though the stated function is pet-health assessment. Persisting authentication-like secrets without clear necessity creates unnecessary credential exposure risk if the local SQLite database is accessed, copied, or mishandled, and the skill context makes this especially suspicious because such capability is not justified by pet analysis.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility file contains authenticated API brokering, token handling, and backend account provisioning logic that is unrelated to pet body health analysis. In the context of a pet-health skill, hidden identity mediation and remote service access materially expand the trust boundary and can cause unauthorized data transmission or account actions without user awareness.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The request path can implicitly register or recover backend user identities via /sys/phoneLogin as a side effect of making a request. Automatically creating accounts tied to local identifiers without explicit disclosure or consent is dangerous because it can bind a user's environment to external services and create persistent remote identities unexpectedly.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill reads local identity material from workspace files and persists default user identifiers and tokens in local storage, even though that behavior is unrelated to pet body health analysis. This increases privacy and credential-handling risk because a seemingly narrow analysis skill gains access to account context and durable identity state.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-report trigger phrases are broad enough that normal conversation about prior analyses could automatically invoke a cloud history lookup. That can cause unintended retrieval of sensitive pet health reports associated with an internal identity without a clear, explicit user confirmation step.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments are automatically saved as local files, but this behavior is not surfaced as a prominent warning at the point users provide media. Silent local persistence of user-uploaded images or videos creates privacy and retention risks, especially for sensitive personal or household content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Although the document includes a privacy section, it does not provide a sufficiently prominent upfront warning that user media and derived identifiers are transmitted to a cloud API for analysis. Users may reasonably assume local-only processing for pet photos/videos unless remote transfer is clearly disclosed before upload or execution.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill resolves current user identity through hidden internal logic without a clear user-facing warning. In a pet health analysis context, silent identity access is not obviously necessary and can violate user expectations, especially when coupled with features that retrieve account-linked data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code reads the full contents of a local file and uploads it to an external analysis API, but this file contains no user-facing notice, consent prompt, or minimization controls. In a skill that processes user-provided media, silent transmission of local content can create privacy and data-handling risk, especially if users may provide sensitive videos or unintentionally select the wrong file.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt without any user-facing disclosure or consent. In this skill context, silently harvesting workspace identity information is especially concerning because pet-health analysis should not require backend identity extraction from local files.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2