Pet Climbing Frame / Cat Tree Activity Heatmap | 宠物爬架/猫树活动热力图

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:22 PM UTC
• Version: 1.0.10

Overview

This skill performs the advertised pet-video analysis, but it also silently creates or reuses an account identity, sends identity data to a backend, and stores tokens locally.

Install only if you are comfortable with cat videos or video URLs being sent to the service backend, an internal user identity being created or reused, and service tokens being stored in a local workspace database. Avoid using private camera feeds, household-sensitive recordings, or internal network URLs unless the publisher clarifies endpoints, retention, account creation, and cleanup behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: This DAO accepts filter keys dynamically and resolves them with getattr(self.__model__, key) without validating that the requested field is permitted. While SQLAlchemy still parameterizes values and prevents classic SQL injection, untrusted callers can query on arbitrary model columns, enabling unauthorized enumeration of sensitive fields or bypass of intended business-level query restrictions.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: The count() method repeats the same unvalidated dynamic column selection pattern as list(), allowing callers to count records by arbitrary model fields. In user-related tables this can support account discovery, data profiling, or side-channel enumeration even if row contents are not returned directly.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no declared permissions while its documented behavior clearly includes shell execution, local file persistence, network access, and likely environment/config usage. This creates a transparency and policy-enforcement gap: users and hosting platforms cannot accurately assess what the skill can do before invocation.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This shared config module reads identity-related environment variables such as sender/open IDs and usernames that are not clearly necessary for a cat climbing-frame heatmap skill. In a multi-skill or shared runtime, this broad environment access increases the risk of unnecessary collection, cross-context data exposure, and accidental reuse of sensitive identifiers by downstream code.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The file implements a generic user-account DAO and user persistence logic that is not justified by the stated purpose of analyzing cat climbing-frame activity videos. Unnecessary identity/account handling expands the attack surface, introduces retention of personal data, and creates opportunity for misuse unrelated to the skill’s declared analytics function.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The User model stores token and open_token fields despite the skill being described as pet video heatmap analytics. Persisting authentication-like secrets without clear necessity increases the blast radius of any local database exposure and is especially risky because SQLite databases in shared workspaces are often weakly protected.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This utility layer creates and persists surrogate user identities and reads internal identity material from workspace files, even though the advertised skill is pet climbing-frame video heatmap analysis. That hidden identity bootstrapping expands the skill's authority beyond its stated purpose and can silently bind user activity to local or remote accounts, creating privacy, account-abuse, and unauthorized-service-access risks.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The HTTP helper can automatically register or log in a user against an external health service via /sys/phoneLogin using generated or recovered identifiers, which is unrelated to cat video heatmap analysis. Because this occurs inside a shared request path, ordinary use of the skill may trigger undisclosed account creation and token acquisition on a third-party backend, violating least privilege and user expectations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default trigger is broad enough to activate on any user-provided cat-tree video URL or file, and the keyword list further expands automatic invocation. Over-broad triggers increase the chance of unintended processing of user content, including automatic upload to backend APIs or local saving without deliberate user consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that local files and network URLs are sent to server-side APIs for analysis, but it does not present a clear user-facing warning that uploaded content or referenced URLs will leave the local environment. This undermines informed consent and may expose sensitive video footage, household interiors, or private camera feeds to third-party services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill says uploaded attachments are automatically saved as local files, but does not warn users about local persistence, retention, or cleanup. Silent persistence can leave sensitive recordings on disk where they may be accessed later by other processes, users, or tools.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code initializes an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) without clearly disclosing that identity binding or account-scoped context will be used. In a skill that uploads or retrieves pet video analysis records, hidden identity resolution can cause privacy issues, cross-account confusion, or unintended access to prior analysis history if the caller does not understand which identity is active.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code accepts either a local file path or a remote video URL, then uploads the file contents or forwards the URL to a backend analysis service without any explicit consent prompt, warning, destination disclosure, or restriction on URL targets in this file. Because the skill processes user-supplied media and can exfiltrate local file contents to a server-side API, users may unknowingly transmit sensitive recordings or internal URLs, and remote URL handling can also increase SSRF-style risk depending on backend behavior.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code reads sensitive identity-related environment variables without any visible notice, consent flow, or minimization controls. Even if common in backend code, undisclosed collection in a shared skill framework can create privacy and security risks by silently binding execution to user/platform identifiers that may later be logged, transmitted, or misused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When debug mode is enabled, the code turns on verbose HTTPConnection and urllib3 debugging and prints request parameters, bodies, and full response text. Even though header values are partly redacted in one path, payloads and responses may still contain user data, service metadata, or tokens from remote systems, leading to sensitive-data exposure in logs.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: This code transmits identity-related data (openId, mobile, source, register flags) to an external service endpoint. External transmission alone is not always a flaw, but in this context it supports covert account provisioning unrelated to the declared pet-video purpose, making the network exfiltration materially more concerning.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2