Pet Breed & Individual Identification Skill | 宠物品种个体识别技能

• Outcome: Review
• Latest audit: Aug 26, 2026 · 12:34 AM UTC
• Version: 1.0.12

Overview

This cloud pet-recognition skill has review-worthy risks because it silently creates/reuses identity state, stores tokens locally, and defaults to insecure development HTTP endpoints despite promising HTTPS.

Review before installing. Use this only if you trust the publisher and cloud service with pet or household media, report history, and identity metadata. The dev HTTP configuration should be fixed to production HTTPS, and users should understand that a local workspace database may store account tokens and reusable identity state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 88% confidence
• Finding: Here getattr(self.__model__, key) is driven by caller-supplied filter keys, allowing unvalidated selection of any mapped attribute on the model. While SQLAlchemy prevents classic SQL injection in the value, this can expose unintended fields for querying, enable unauthorized enumeration over sensitive columns, and cause crashes or information leakage if invalid/internal attributes are referenced by upstream callers.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 88% confidence
• Finding: This count() helper repeats the same pattern of using caller-controlled keys to resolve model attributes dynamically. If exposed through higher-level interfaces, it can permit unauthorized probing of sensitive fields and facilitate record enumeration based on internal attributes that should not be queryable.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents the ability to read/write local files, access environment/configuration, invoke shell commands, and make network requests, yet it declares no permissions or user-facing consent boundaries. This creates a dangerous mismatch: hosts or reviewers may treat the skill as low-risk while it can exfiltrate local data, invoke external services, and persist artifacts during normal operation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The privacy section promises HTTPS/TLS-only transmission, but the interface exposes a user-configurable `--api-url` with no stated HTTPS enforcement. An attacker or misconfigured integration could direct uploads to an insecure or malicious endpoint, undermining confidentiality and integrity for pet images/videos and associated identity metadata.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata promises pet breed and individual recognition, but the implementation is a generic video-analysis and history-listing client. This mismatch is dangerous because users and host platforms may grant trust, permissions, or data access based on the declared pet-recognition purpose while the code actually processes arbitrary video inputs and retrieves analysis history, enabling deceptive scope expansion.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The function names, docstrings, and CLI help text explicitly describe a video-analysis tool rather than a pet-recognition skill. This contradiction increases the risk of misleading operators and automated governance systems, making it easier for a broadly scoped analysis utility to be embedded under an innocuous pet-care label.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file exposes generic CRUD-style network methods and arbitrary API forwarding helpers that are not constrained to pet breed or individual recognition tasks. In the context of a narrowly scoped pet-recognition skill, this broad remote-service capability materially increases attack surface and enables unrelated data access or command-and-control style behavior if other parts of the skill invoke it with attacker-controlled URLs or payloads.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The http_post/http_put/http_get/http_delete methods accept caller-provided URLs and arguments and directly perform outbound requests without visible restriction, validation, or scope enforcement. For a pet recognition skill, arbitrary outbound HTTP is unnecessary and dangerous because it can be repurposed for data exfiltration, unauthorized third-party access, or reaching unintended internal/external services depending on runtime environment.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file defines persistent user-account management, including usernames, real names, email, tokens, and default-user lookup logic, which does not match a pet breed/individual recognition skill. This mismatch materially increases risk because unnecessary identity/account storage broadens the attack surface and suggests undeclared data collection unrelated to the advertised function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The User model stores authentication-related and sensitive identity data such as token, open_token, username, realname, and email without any visible justification from the pet-recognition skill context. In this context, collecting and locally storing such data is especially dangerous because users would not reasonably expect account/token handling from an image-analysis pet skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code automatically creates and alters a local SQLite database in a shared workspace data directory even though the described skill is for pet recognition/analysis, not stateful account or database administration. This undisclosed persistence is risky because it creates hidden local state, stores user-related data beyond expectations, and may enable cross-component data exposure through the shared data location.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility module contains generic backend account provisioning, token management, and remote API request logic that is unrelated to pet breed or individual recognition. In the context of a pet-recognition skill, this is dangerous because it enables silent identity handling and broad outbound communications that expand the trust boundary far beyond what the skill description justifies.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can silently register or log in a backend user by sending an openId/mobile-derived identifier with register=1 and silent=1, then persist returned tokens locally. For a pet recognition skill, hidden account creation is unjustified and risky because it can create backend identities without meaningful user awareness or consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill returns payment and recharge instructions when a backend responds with status 402, indicating commercial account/payment workflow coupling inside a pet-recognition utility path. This is suspicious in-context because it introduces monetization and account-balance handling unrelated to the advertised recognition function and can steer users into installing additional skills or services.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The history-report trigger phrases are broad enough that ordinary requests about reports could automatically invoke a cloud query without clear user confirmation. In this skill, that is more dangerous because report listing is tied to internally managed identity and may expose prior analysis metadata unexpectedly.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default activation rule is overly broad: any pet image/video needing identification may trigger the skill automatically, increasing the chance of unintentional execution and data upload. In context, the skill accepts local files and URLs and is designed to send content to a cloud API, so accidental invocation has privacy consequences beyond a simple UX issue.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill mandates automatic internal identity handling, including reusing or creating a default local user without user opt-in. This can silently link analyses and history across sessions or people on the same system, exposing prior report metadata and creating unintended cross-user data association.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill reads arbitrary local file contents and sends them to a remote analysis service, but there is no visible user-facing consent, warning, or policy check in this code path. In a skill that is misrepresented as pet recognition, users may provide local media without understanding that full file contents are being uploaded, creating privacy and data-exfiltration risk.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The script analyzes local files or remote URLs via a backend API and prints only a generic progress message, without clearly warning users that video content may be transmitted off-device. In the context of a mislabeled pet-recognition skill, this is more concerning because users may submit home or household pet footage that can contain sensitive personal, location, or bystander information without informed consent.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The get_download_url method sends caller-supplied data to a remote endpoint, and the file generally acts as a transport layer for outbound requests without any visible user notice, consent flow, or minimization controls. While this may be normal infrastructure code, in a consumer-facing pet skill it creates privacy and transparency risks because pet-related identifiers or user-linked metadata could be transmitted off-device without clear disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Enabling HTTPConnection and urllib3 debug logging at runtime can expose full request and response details, including tokens, identifiers, and payload data, to logs or stdout. Even if only active in debug mode, this creates a real confidentiality risk because the same module later handles authentication headers and user identity data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code automatically derives, creates, and persists a default open-id/user identity when none is supplied, including reading from a workspace file and writing to a local database. That is risky because it establishes durable identity state without clear user notice, and in this skill context there is no apparent need for hidden identity provisioning to perform pet recognition.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request path assembles and transmits usernames/open IDs and multiple tokens in headers and body fields to remote services, while also caching tokens locally. In a pet recognition skill, this undisclosed identity and credential transmission is more dangerous because users would reasonably expect image analysis, not background account and token exchange.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 92% confidence
• Finding: This call sends registration/login data to an external endpoint, including openId, mobile, and source, as part of silent account provisioning. External transmission of identity data is inherently sensitive, and here it is especially unjustified because the skill's stated purpose is pet breed/individual recognition rather than account onboarding.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2