Pet Detection Skill | 宠物检测技能

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:38 PM UTC
• Version: 1.0.12

Overview

The skill performs pet-detection analysis but also silently manages identities, creates or reuses remote accounts, stores tokens locally, and queries cloud history, so it needs Review before installation.

Install only if you are comfortable sending household pet images or videos, submitted URLs, and account-linked identifiers to the publisher's cloud service. Review the silent login/registration behavior, local SQLite token storage, workspace identity-file use, and cloud history lookup before use, and prefer a version that asks for explicit consent and documents retention and cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises only pet detection, yet the workflow and examples require shell execution, network access, local file persistence, and likely environment/config usage without declaring those capabilities. This undermines least-privilege expectations and prevents users or hosting platforms from accurately assessing the trust boundary, especially because uploaded media and account state may be handled locally and remotely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is simple pet detection, but the skill also instructs automatic identity handling, remote account registration/login, cloud history retrieval, report link generation, and local token/account storage. This functionality expansion is security-relevant because it silently broadens data collection and persistence beyond what a user would reasonably expect from an image/video classifier.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The referenced API document describes pet health analysis and report export endpoints, which conflicts with the declared skill purpose of pet detection from images/video. This kind of capability mismatch is dangerous because it can conceal undeclared data processing, broaden data collection scope, and cause integrators or reviewers to grant permissions based on an inaccurate manifest.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implies behavior centered on pet health analysis rather than simple pet presence detection, suggesting the skill may invoke more sensitive analysis workflows than advertised. This is risky because users and platform reviewers may not understand the true function, leading to consent, privacy, and policy-compliance issues, especially if uploaded files are processed for health reporting.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes a hidden identity-resolution path and a history-listing feature (`--list` with internally resolved OpenID) that are not disclosed by the pet-detection description. This expands the skill from media analysis into user-data access, creating a privacy and authorization risk if users can enumerate or retrieve analysis history tied to an internal identity without clear consent and scope limitation.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation is a generic analysis/reporting client that accepts arbitrary files and URLs, then forwards them to backend analysis endpoints. This materially exceeds the advertised pet-detection scope, creating a capability mismatch that can mislead users and integrators into submitting sensitive content to a broadly scoped service.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file implements a broad generic API wrapper with raw HTTP verbs plus add/edit/delete helpers that are not constrained to pet-detection functions. In a skill advertised only for pet monitoring, this creates unnecessary capability expansion and could let other parts of the skill invoke arbitrary backend operations, increasing the blast radius if the skill is misused or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The get_user_by_username capability is unrelated to detecting pets in images or video and introduces access to user-account data/functions outside the declared skill scope. In a narrowly scoped pet-detection skill, this mismatch is suspicious because it enables identity lookup and potential user enumeration without a clear business need.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file defines a full user-account persistence layer, including profile lookup and default-user selection, which is unrelated to a pet-detection skill's stated purpose. In context, unexplained identity/data-management code broadens the attack surface and suggests hidden collection or repurposing of user data beyond what users would reasonably expect from pet monitoring.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores personal profile attributes and authentication-related tokens (username, realname, email, birthday, token, open_token) without any evident linkage to pet detection functionality. In this skill context, collecting and persisting such sensitive data is unjustified and increases privacy, compromise, and misuse risk if the local database is accessed by another component or attacker.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer performs token management, automatic account provisioning, and authenticated API interactions that are unrelated to the stated pet-detection purpose. In the context of a vision skill, hidden identity bootstrap and outbound service access materially expand the trust boundary, creating risk of undisclosed data transmission, unauthorized account creation, and platform abuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads workspace identity material from data/smyx-api-key.txt, queries a local user database, and creates fallback identities automatically. For a pet-monitoring skill, this identity harvesting and persistence behavior is out of scope and dangerous because it can silently bind user activity to local credentials or fabricate identities without user knowledge.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The workspace discovery logic walks runtime paths, inspects environment variables, and creates data/skills directories. While not directly exploit code, this gives the skill broad filesystem awareness and write capability beyond what a pet-detection feature should need, increasing the blast radius if combined with other components or malicious updates.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The auto-trigger phrases for historical report access are broad enough to match ordinary user requests, causing the skill to query cloud history without strong confirmation. In this skill, that is more dangerous because history retrieval is tied to internally associated identities, so an ambiguous phrase could expose prior report metadata unexpectedly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that uploaded attachments and media files are automatically saved locally, but it does not clearly warn users about local retention, storage location, duration, or cleanup. For home-monitoring photos and videos, silent local persistence increases privacy risk because sensitive household imagery may remain on disk beyond the analysis session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` initializes internal user identity without clear user-facing disclosure, and the corresponding CLI option is hidden from help. Hidden identity handling is dangerous because it can silently bind requests to an internal account context, enabling unintended data access, cross-user leakage, or audit ambiguity.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads full local file contents and uploads them to an external analysis service without any visible consent prompt, notice, or minimization logic in this component. This can cause unintentional exfiltration of sensitive local media or documents if the skill is invoked on the wrong file or under misleading expectations.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: When given an HTTP(S) input, the skill forwards the URL to the analysis service without visible notice that the URL itself will be transmitted to a third party. While lower risk than direct file upload, this still exposes user-supplied network locations and may leak sensitive or private resource identifiers.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script accepts a hidden API key parameter without disclosing credential handling to users, creating a risk that sensitive credentials are passed on the command line, exposed in shell history, process listings, logs, or forwarded to a remote service unexpectedly. In a skill context that performs remote analysis and history lookup, opaque credential collection increases the chance of accidental secret leakage and undermines informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Authentication tokens are persisted in plaintext-like form in a local SQLite database field, which makes credential theft straightforward if the file is copied, exposed through backups, or read by another local process. In a pet-detection skill, this is especially unjustified because such secrets are not obviously needed for object detection and therefore represent avoidable sensitive data exposure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill reads a workspace identity file containing an API key/open-id surrogate without any user-facing disclosure or consent flow. Even if intended for convenience, silently consuming local identity material is risky because users cannot reasonably infer that a pet-detection skill will inspect and use workspace credentials.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code automatically performs a remote phoneLogin/register flow with silent=1 and register=1, meaning it may create or reuse an account without clear user awareness. In this skill context, undisclosed registration and token acquisition are especially concerning because they are unrelated to detecting pets in images or video.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This request sends identity-linked data to an external service for login/registration. External transmission alone is not always unsafe, but here it is coupled with silent account provisioning and is unrelated to the advertised pet-detection capability, making the transmission materially riskier and insufficiently disclosed.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：视频支持 mp4/avi/mov 格式，图片支持 jpg/png/jpeg 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供家庭宠物监控参考，具体处置请结合实际情况 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📁 格式支持 | 当显示历史检测报告清单的时候，从数据 json 中提取字段  作为超链接地址，使用 Markdown 表格格式输出，包含" |

• Confidence: 89% confidence
• Finding: The malformed/hidden instruction content near the notes section suggests obscured metadata or truncated guidance affecting how historical report links are extracted and displayed. Hidden or invisible instructions are dangerous in agent skills because they can conceal behavior from reviewers and users, making prompt/tooling manipulation harder to detect.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "pet-detection-analysis"
description: "Detects cats, dogs, and birds appearing in the target area; supports video stream and image detection, suitable for home pet monitoring scenarios. | 宠物检测技能，检测出目标区域内出现的猫、狗、鸟，支持视频流和图片检测，适用于家庭宠物监控场景"
version: "1.0.13"
license: "MIT-0"
---

• Confidence: 74% confidence
• Finding: The metadata poisoning indicator is plausible because the manifest contains suspicious formatting signals and the file includes hidden-instruction evidence elsewhere. While the description itself looks benign, poisoned metadata in skill manifests can influence tool routing, trust decisions, or downstream parsing in ways that are not visible to normal reviewers.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2