ClawHub
Back to skill

Security audit

Pet Drying Box Heat Stress Analysis | 宠物烘干箱内热应激预警

Security checks across malware telemetry and agentic risk

Overview

The skill does the advertised cloud video analysis, but it also silently creates or reuses account identity, stores access tokens locally, and supports account-scoped history lookup without enough user control.

Review before installing. Use this only if you are comfortable sending pet drying-box videos or URLs to the configured Life Emergence cloud service and with the skill creating/reusing a local account identity, storing tokens in a workspace SQLite database, and querying cloud report history. Prefer a single-user workspace and remove the local data database/tokens if you uninstall or rotate identities.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
This method applies caller-supplied filter keys directly via getattr(self.__model__, key). While SQLAlchemy prevents classic SQL injection here, untrusted callers can still probe model internals, trigger exceptions with invalid attribute names, and query on sensitive columns the API may not intend to expose. In a shared DAO used across skills, that broad query surface is more dangerous because it can enable unauthorized data access patterns beyond the pet video-analysis scope.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
Like the list() method, count() accepts arbitrary filter keys and resolves them dynamically on the ORM model. This can expose unintended schema details, support unauthorized record enumeration on sensitive fields, and cause avoidable exceptions if invalid attributes are supplied. The presence of identity/token storage in the same module increases the value of such enumeration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares no permissions while its documented behavior clearly involves shell execution, local file handling, environment use, and network access. This mismatch is dangerous because it hides the real trust boundary from reviewers and users, increasing the chance that sensitive files, URLs, or local state are processed without informed approval.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The documentation says the system will automatically reuse or create a local default user identity even though the skill's core purpose is video-based heat-stress analysis. Introducing hidden identity state can cause cross-session data linkage, unauthorized report access, and privacy issues if multiple users share the same environment or if reports are keyed to an implicit local account.

Description-Behavior Mismatch

Medium
Confidence
77% confidence
Finding
The skill documentation expands scope from simple video analysis to image analysis and cloud history-report querying, which broadens the data handling surface beyond the manifest's narrower description. Scope expansion is risky because it can enable unexpected processing, retention, and retrieval of user data that a reviewer or user would not reasonably infer from the top-level metadata.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script exposes a hidden `--list` mode that returns analysis history via `show_analyze_list(open_id)`, but this capability is not disclosed in the skill metadata, which describes only video heat-stress analysis. Undocumented history access expands the skill's effective privilege surface and may allow users or integrators to retrieve prior analysis records unexpectedly, especially when combined with implicit identity resolution.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code initializes an internal user identity using `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` even though the advertised function is simple video analysis. This introduces an undeclared account-context dependency that can bind actions or history retrieval to an internal identity without clear user awareness, increasing the risk of cross-account data access or misuse of internal account capabilities.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill exposes a report-listing function that goes beyond the described trigger behavior of analyzing a provided pet drying box video. If this method is reachable through the agent surface, users may enumerate prior analysis records and exported report links, potentially exposing other users' sensitive pet-health or customer data. The danger is increased because the code comments show `open_id` access control was intentionally disabled, removing an obvious tenant/user scoping check.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This service exposes broad generic HTTP and CRUD-style capabilities that are not constrained to the stated pet heat-stress video analysis purpose. In a skill that is supposed to analyze user-provided drying-box videos, unrestricted wrappers for arbitrary GET/POST/PUT/DELETE increase the attack surface and can enable unintended remote actions, data access, or misuse by other components.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The code includes mutation-oriented methods such as add, edit, delete, and generic POST/PUT/DELETE wrappers even though the manifest describes an analysis-focused skill. This mismatch matters because it creates hidden capability for state-changing remote actions that users would not reasonably expect when submitting pet videos for heat-stress detection.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file implements a generic local persistence layer and user DAO that is far broader than needed for pet drying-box heat-stress video analysis. Scope creep like this increases attack surface, enables data retention unrelated to the declared function, and makes it easier for the skill to accumulate or correlate user data across contexts.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, none of which are justified by the manifest's pet heat-stress analysis purpose. Unnecessary collection of identity and token data creates substantial privacy and credential-risk exposure if the local database is accessed, reused across skills, or mishandled.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The utility layer performs identity resolution, silent user creation, token acquisition, and persistence to a local database, which is materially broader than the stated pet heat-stress video analysis purpose. This creates undisclosed account lifecycle and credential-handling behavior, increasing the risk of privacy violations, unauthorized account creation, and token misuse if the environment is shared or compromised.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes processing local videos and URLs via server-side APIs but does not clearly warn users that submitted media or remote links are transmitted to cloud services. This creates a privacy and data-governance risk, especially because pet videos may contain people, home interiors, clinic environments, or other sensitive context beyond the pet itself.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments or media files will be automatically saved as local files, but this behavior is not clearly disclosed as a privacy/security implication. Automatic persistence increases the risk of unintended retention, leakage through shared storage, and later access by other processes or users on the host.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The hidden `--open-id` parameter is suppressed from help output but still used to resolve internal identity, meaning account-scoped behavior exists without user-facing disclosure. Hidden identity parameters are dangerous because they can be invoked by knowledgeable users or downstream tooling to impersonate or select identities in ways the normal interface does not make transparent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script accepts a local file path or remote URL and then invokes server-side analysis via skill.get_output_analysis() without any explicit user-facing disclosure or confirmation that the video may be transmitted to an external service. Because the content is pet video from a drying-box setting, it may still contain sensitive operational or customer data, and silent transmission creates a privacy and consent risk rather than a code-execution flaw.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The delete method provides a generic remote deletion capability without any visible guardrails, confirmation flow, or indication that destructive actions are part of this skill's expected behavior. In the context of a pet heat-stress analysis skill, such hidden destructive capability is unexpected and could be abused to remove remote resources or trigger harmful backend-side effects.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
When debug mode is enabled, urllib3/http.client logging is turned on globally, which can expose full request and response metadata and potentially sensitive payloads or authentication material in logs. Because this affects all HTTP traffic in process and there is no masking or user disclosure, it can leak private video-analysis data and backend tokens.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The code reads an internal identity value from a workspace file and reuses it silently as the current open-id. This is an undisclosed identity-binding behavior that can cause actions or requests to be attributed to an unexpected local identity, especially in shared workspaces or reused installations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This request wrapper automatically injects usernames, tokens, tenant metadata, and skill platform identifiers into outbound requests without clear user-facing consent boundaries. In the context of a pet video analysis skill, that broad data propagation is riskier because it extends beyond what is necessary for analyzing uploaded footage and can expose account linkage and internal identifiers to remote services.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
91% confidence
Finding
The code sends a POST request to an external health endpoint to silently register or log in a user using locally derived identifiers. External transmission is expected for cloud-backed skills, but here it includes identity bootstrap behavior unrelated to core pet heat-stress detection, making the data flow more sensitive and less transparent than necessary.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供烘干安全参考，不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 🔎 使用提醒 | 检测到高风险或紧急级别热应激信号时，应提示用户立即停止烘干、降低温度、开盖通风并观察宠物状态 |
Confidence
81% confidence
Finding
The hidden-instructions indicator suggests the manifest may contain invisible or non-obvious control characters or concealed directives. In agent skill contexts, hidden text is dangerous because it can manipulate model behavior, evade review, or smuggle policy-relevant instructions that are not visible to ordinary auditors.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-drying-box-heat-stress-analysis"
description: "Triggers when a user provides a pet drying box area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for pet heat stress signal detection, analyzing open-mouth panting intensity, tongue color (pink/cyanotic), and body movement frequency to identify early heat stress signals, outputting risk levels and supporting auto-cooling or stopping drying. Application scenarios: pet drying boxes, pet grooming stores, pet hospitals. Development reason: prevent heatstroke and improve safety. | 当用户提供宠物烘干箱区域的视频URL或文件时，触发本技能进行烘干箱内热应激预警分析；支持通过上传本地视频或网络视频URL，调用服务端API进行热应激信号识别，分析张口喘气强度、舌体颜色（粉红/紫绀）、身体移动频率，识别热应激早期信号，输出风险等级，支持自动降温或停止烘干。应用场景：宠物烘干箱、宠物美容店、宠物医院。"
version: "1.0.12"
license: "MIT-0"
---
Confidence
74% confidence
Finding
The YARA hit for tool/metadata poisoning indicates the manifest contains patterns associated with deceptive or manipulative schema content. In this context, metadata is especially sensitive because agents may trust manifest fields for activation and behavior, so poisoned descriptions can cause overbroad triggering, unsafe tool use, or reviewer confusion.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2