ClawHub
Back to skill

Security audit

Pet Carrier Respiratory Rate Analysis | 宠物航空箱内呼吸频率监测

Security checks across malware telemetry and agentic risk

Overview

The skill matches its pet-video analysis purpose, but it also silently creates or reuses identity records, logs into a remote health service, and stores tokens locally.

Install only if you are comfortable with pet videos or URLs being sent to the configured service, automatic cloud history lookups, and local storage of account tokens in the workspace data directory. Verify the intended API environment before use, especially because this artifact defaults to dev/private HTTP endpoints rather than the public production hosts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
This method accepts arbitrary filter keys and resolves them against model attributes with getattr(self.__model__, key). While it is not classic SQL injection because SQLAlchemy parameterizes values, an attacker or untrusted caller can query on unintended columns and trigger exceptions or unauthorized data access paths if higher layers pass user-controlled filter dictionaries. In a shared DAO handling user records, that broad query surface is more dangerous because it can expose account metadata unrelated to the pet-video purpose.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
The count() API has the same broad dynamic field-selection issue as list(), allowing callers to probe arbitrary model columns via filter keys. Even without SQL injection, this can support schema probing, record enumeration, and unauthorized metadata inference when the DAO is reused by other components.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs use of shell execution, network access, local file handling, and implicit identity handling, but does not declare permissions or surface those capabilities to reviewers and users. This weakens trust boundaries and consent because a seemingly simple analysis skill can read/write local data and send content to remote services without explicit capability disclosure.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script exposes a hidden `--list` mode that retrieves prior analysis records by `open_id`, which goes beyond the declared single-video respiratory analysis behavior. Because identity handling is also hidden from normal help text and the code accepts a caller-controlled identifier, this can enable unauthorized access to another user's analysis history if downstream authorization is weak or absent.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The comment states identity does not require user input and is hidden from help, but the code still accepts `--open-id` and passes it into identity resolution. This mismatch is security-relevant because it suggests the author intended internal-only identity handling while leaving a user-influenceable path that could permit impersonation or insecure direct object reference behavior.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill exposes report-listing functionality and enriches returned items with export URLs, which goes beyond the described single-video analysis behavior in the manifest. Hidden or undocumented capabilities increase the attack surface and can enable unauthorized discovery of prior analysis records or report artifacts if upstream access controls are weak or absent.

Description-Behavior Mismatch

Low
Confidence
80% confidence
Finding
The output automatically includes a report export image link that is not disclosed in the manifest. Even if the link is intended, undisclosed export capabilities can expose report identifiers or downloadable artifacts to users who did not expect persistence or external retrieval of analysis results.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script exposes a hidden capability to list prior analysis records via `--list` and `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the manifest's stated purpose of analyzing a supplied pet video. Undocumented data-access features increase the risk of unintended information disclosure, especially if historical records contain user identifiers, video metadata, or prior results and authorization checks are weak or absent.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes broad generic network and CRUD wrappers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, `page`, `list`) that are not constrained to the stated pet respiratory-rate analysis purpose. In a skill that should process pet videos, these helpers can enable arbitrary backend interaction if other parts of the skill pass user-influenced URLs or parameters, expanding the attack surface for unintended data access, SSRF-style requests, or unauthorized API operations.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The file defines a shared local persistence layer for user/account data including username, realname, email, birthday, token, and open_token, which is unrelated to the stated pet respiratory-rate video-analysis purpose. Collecting and locally storing this breadth of identity and token data increases privacy and credential exposure risk, especially because the DAO is placed in a reusable common module and writes to a shared workspace database.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
This utility reads identity material from workspace files and, if absent, silently creates and persists synthetic user identifiers in a local database. For a pet respiratory-rate analysis skill, this identity bootstrapping is unrelated to the stated function and creates undisclosed account/identity state that could be reused for network actions under a fabricated or inherited identity.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The HTTP helper can automatically register/login a user against a health service via /sys/phoneLogin using locally derived identity data, then cache tokens for future requests. That exceeds the justified capability of analyzing pet carrier videos and creates unauthorized external account activity plus token acquisition without explicit user approval.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that local uploads or network URLs will be processed by server-side APIs, but it does not clearly warn that user-provided media may leave the device and be transmitted to a remote service. Video of pets in carriers can still contain sensitive metadata, location cues, travel details, or personal surroundings, so undisclosed off-device transfer creates a privacy and consent risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill says uploaded attachments are automatically saved as local files, but it does not inform users about local persistence, storage location, retention, or cleanup. Silent local storage increases the risk of unintended disclosure, especially on shared systems or when media files contain sensitive visual or metadata content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill automatically queries a cloud API for account-associated historical reports using internal identity linkage, but it does not clearly warn the user that remote account data will be retrieved. Automatic cloud retrieval tied to hidden identity handling can expose private history unexpectedly and reduces user awareness of when account data is being accessed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill reads local file contents and sends them to a backend analysis service, but this code shows no user-facing disclosure, consent flow, or data-handling notice. For a media-analysis skill, exfiltrating local video data to a remote service is expected technically, but failing to make that transfer explicit creates a privacy and transparency risk, especially if videos may contain people, locations, or metadata.

Missing User Warnings

Low
Confidence
76% confidence
Finding
User-supplied video URLs are forwarded to the backend service without any visible disclosure. This can surprise users and may also cause the backend to fetch third-party resources, with privacy implications and possible secondary risks if the service does not strictly validate allowed URL targets.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
When debug mode is enabled, urllib3/http.client request debugging is turned on globally, which can expose full request and response metadata in logs. Because this utility also handles tokens and identity-bearing requests, debug logging can leak sensitive headers, parameters, or response bodies to logs without user awareness.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt without any visible user disclosure or consent flow. In the context of a pet video analysis skill, silently reusing workspace identity data broadens access beyond what users would reasonably expect.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code automatically sends identity data such as openId, mobile, and source to a remote service as part of a login/registration call. Because that transmission is hidden inside a utility function and not tied to an explicit consent step, users may unknowingly disclose identifiers when merely attempting pet respiratory analysis.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The general request wrapper forwards arbitrary data, params, and authentication headers to remote services, but this file shows no built-in disclosure, allowlist, or purpose limitation. In a skill advertised for local/network pet video analysis, a broad hidden exfiltration-capable wrapper increases the risk that user media metadata or identifiers are sent off-box unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
This line performs an external POST to a health-service endpoint with identity-bearing JSON. External transmission is expected for some cloud-backed skills, but here the destination and payload are tied to hidden account registration/login behavior unrelated to pet breathing-rate calculation, making the transmission unjustified and risky.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2