Security audit
Security checks for vulnerabilities and agentic risk
This skill is a pet video breathing-analysis tool, but it also silently creates or reuses an identity, logs into a remote service, stores tokens locally, and can query cloud history records.
Install only if you are comfortable sending pet carrier videos or video URLs to the configured LifeEmergence backend and allowing the skill to create/reuse a local identity, store authentication tokens in the workspace data database, and query prior cloud analysis reports without asking for an identity each time.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
Automatic user/open-id generation, filesystem persistence, remote login/registration, and authenticated generic HTTP client behavior go well beyond the stated purpose of pet video breathing analysis. In a skill that may process user media, undisclosed identity creation and tokenized backend access create significant privacy, consent, and abuse concerns.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-pet-carrier-respiratory-rate-analysis"
description: "Triggers when a user provides a video of a pet inside an airline carrier/crate for analysis; supports local uploads or network URLs to call server-side APIs for respiratory rate monitoring, detecting chest/abdomen rise-fall cycles to calculate resting breathing frequency (breaths/min), and outputting an alert when the rate exceeds the safety threshold (>40 bpm), helping early detection of hypoxia, anxiety, or health abnormalities during pet air transport to reduce transport risks (without diagnosing diseases). Application scenarios: pet airline carriers, pet cargo transport, long
The skill declares no explicit tool scope or permission boundaries even though the documentation indicates capabilities that touch environment data, filesystem access, network access, and shell execution via python -m .... In an agent setting, missing least-privilege declarations increases the chance of over-broad execution and makes it harder to contain harmful or unintended behavior.
The skill states that local files and URLs are sent to server-side APIs but does not clearly warn users that their media may be transmitted to cloud services. For pet-transport videos and associated reports, this is a privacy and transparency problem that can lead to uninformed sharing of potentially sensitive content.
The documentation expands the skill from media analysis into cloud-based historical report retrieval, which broadens data access beyond the manifest’s primary purpose. This scope creep increases the chance of unintended exposure of prior reports or cross-session data, especially when paired with automatic identity association.
Overly broad trigger phrases for history-report queries can cause the skill to auto-invoke cloud retrieval in response to generic user requests. In combination with automatic identity handling and remote APIs, this raises the risk of unintended data access or disclosure without clear user consent.
The skill’s stated purpose is single-video respiratory-rate analysis, but show_analyze_list() exposes historical analysis records for an open_id. This expands the data access scope from processing a supplied video to retrieving prior pet health-related records, creating a privacy and data-minimization issue if users can access records beyond what is necessary for the current task.
This code hardcodes the command description, argument help text, and status/error messages in Chinese only. That imposes a specific language on all users without any opt-in, selection mechanism, or documented region-specific justification, which matches the locale-policy violation criteria.
The code initializes and uses an internal identity (open_id) even though identity is not required to analyze a provided video file or URL. This unnecessary identity coupling increases the chance of cross-user data access, account correlation, or unauthorized retrieval of historical records, especially because list mode later relies on CURRENT__OPEN_ID.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
User-facing output strings are hard-coded in Chinese, such as the analysis report header and export-link text. The file does not provide any language selection, opt-in, or justification that this skill is intentionally limited to a Chinese-speaking or region-specific context.
This code accepts either a local file path or an arbitrary remote HTTP/HTTPS URL and forwards the content to a backend analysis service without any visible consent prompt, safety notice, or URL restriction in this code path. In a skill that processes pet transport videos, this creates privacy and trust risks because users may unknowingly upload sensitive media or cause the service to fetch attacker-controlled URLs, increasing exposure to unintended data transfer and possible downstream SSRF risk depending on backend handling.
The function forwards either a local file path or a network URL to skill.get_output_analysis(...) for server-side analysis without any explicit notice that pet videos may be transmitted to an external service. Because these videos may contain sensitive household, location, or personal information, silent external processing creates a privacy and consent risk that is more concerning in a consumer pet-transport context where users may not expect backend sharing.
The script exposes a hidden --list mode that retrieves prior analysis history by open_id, which is outside the stated purpose of analyzing a user-provided pet video. Hidden data-access functionality increases the risk of unauthorized retrieval of prior user results, especially because the access-control model is not visible here and the feature is not transparently disclosed.
This file exposes generic add/edit/delete/list and arbitrary http_get/http_post/http_put/http_delete wrappers that are not constrained to the stated pet respiratory-rate analysis use case. In a skill that accepts local uploads and network URLs and can call server-side APIs, this broad network capability increases the attack surface for misuse, including reaching unintended internal or external endpoints, enabling unauthorized data operations, or repurposing the skill as a generic proxy/client.
This file defines persistent user/account CRUD capabilities that do not align with the declared purpose of analyzing pet breathing rates from carrier videos. Functionality that exceeds the skill's stated scope expands the attack surface, creates opportunities for unauthorized data collection or account tracking, and makes it harder to reason about least privilege. In this context, the mismatch is more concerning because a media-analysis skill should not need a general user database layer with account lookup and mutation features.
The User model stores identity and authentication-adjacent data such as username, realname, email, token, and open_token, which are unrelated to pet respiratory-rate computation. Collecting and persisting this data increases privacy and credential-handling risk, especially if tokens are stored in plaintext and the skill's purpose does not justify their retention. The skill context makes this more dangerous because users would reasonably expect video analysis, not background account-data storage.
Detected: suspicious.install_untrusted_source