Back to skill

Security audit

Pet Eating Speed Slow Feed Analysis | 宠物进食速度检测与慢食干预

Security checks across malware telemetry and agentic risk

Overview

The pet-video analysis workflow is mostly coherent, but it needs Review because it silently creates or reuses backend identity, stores tokens locally, and sends media/report requests to remote services.

Install only if you are comfortable with pet feeding videos or URLs being sent to the configured backend, a local default identity being created or reused, report history being fetched from the cloud, and backend tokens being stored in the workspace database. Use an isolated workspace and avoid sensitive household footage until the publisher clarifies endpoint selection, token storage, retention, and account behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs use of capabilities equivalent to shell execution, network access, and local file read/write, yet no permissions are explicitly declared to the user. This undermines least-privilege expectations and can cause users or hosting agents to approve a skill without understanding that it saves files locally, invokes scripts, and sends data to remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is pet eating-speed analysis, but the observed behavior includes account creation/authentication, token storage in SQLite, identity reuse, and historical report retrieval from remote health APIs. This is dangerous because it hides materially different data-processing and authentication behavior from users, increasing the chance of covert tracking, unauthorized account lifecycle actions, and unexpected retention of sensitive metadata.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script exposes a hidden '--list' mode that retrieves analysis history, which goes beyond the declared purpose of analyzing a single provided pet-feeding video. Because this capability is not disclosed in the skill metadata and is tied to user-specific records, it increases the risk of unauthorized access to historical pet health data and violates least-privilege expectations.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code silently resolves an internal user identity and then uses that identity to access per-user analysis history without making that data flow clear to the user. In a skill that is presented as one-off video analysis, undisclosed identity binding and historical record access create unnecessary privacy and authorization risks, especially if open_id resolution can be influenced or mis-bound.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill exposes a report-listing capability that is broader than the manifest’s stated behavior of analyzing a user-provided video. More importantly, the listing path appears to call the backend without enforcing an `open_id` or other visible per-user access control in this file, which can enable unauthorized enumeration of prior analysis records if the backend is permissive.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The code comments indicate that missing `open_id` should be treated as an error, but the enforcement is intentionally disabled before invoking the analysis API. If `open_id` is meant to bind requests to a user or tenant, skipping it weakens accountability and can cause analysis jobs to run without proper authorization context.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The report-listing path likewise comments that `open_id` should be required, yet proceeds without it. In a listing function this is more dangerous than the analysis path, because it may expose metadata, report contents, or export links for other users’ feeding-analysis records if the backend does not strictly enforce authorization.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script exposes a `--list` path that retrieves a user's historical analysis records, which goes beyond the declared per-video analysis behavior in the skill description. Hidden or undocumented data-access functionality increases the chance of unauthorized or unexpected access to prior user data, especially when paired with implicit identity resolution.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code resolves a current `open_id` and uses it to fetch analysis history, but this identity-based data access is not justified by the stated skill purpose of analyzing a supplied video. This creates privacy and authorization risk because a hidden identifier can be used to enumerate or retrieve prior records without clear user intent or transparent access controls.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility code manages default open-id creation, reads identity material from local workspace files, and persists user records/tokens despite the skill being presented as a pet eating-speed analyzer. That creates hidden identity state and broadens data collection beyond what is necessary for bowl-video analysis, increasing privacy and account-linkage risk if reused across skills or workspaces.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code can silently register or log in a user against a health backend using generated or reused identifiers, then cache tokens locally for future requests. For a feeding-speed detector this is unjustified hidden account creation and network identity transmission, exposing users to undisclosed tracking, backend account binding, and token compromise risks.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
On balance errors the request helper returns a payment/upsell workflow unrelated to the declared analysis and intervention purpose of the skill. This is risky because shared utility code can steer users into financial actions they did not request, and it indicates the skill bundle includes broader commercial behavior than advertised.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that local uploads and remote URLs are sent to server-side APIs, but it does not present a clear privacy warning that user-supplied pet videos may be uploaded, stored, or processed in the cloud. In a video-analysis context, this can expose household imagery, location clues, routines, and other sensitive content without informed consent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow specifies that uploaded attachments are automatically saved as local files, but there is no warning about local persistence, storage location, or cleanup. Silent local retention increases the risk of unintended exposure of user media to other processes, users, backups, or future sessions.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script submits local video content or a remote URL to server-side analysis but provides no clear user-facing disclosure that media and related metadata may be transmitted to an external service. Because pet-bowl area videos can still reveal household interiors, schedules, or other sensitive context, silent transmission creates a meaningful privacy and consent issue.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The User model persists token and open_token directly in a local SQLite database with no indication of encryption, hashing, scope limitation, or secret-store usage. If the workspace or database file is read by another skill, sub-agent, local user, or through path/data exposure, these credentials could be stolen and reused to impersonate users or access upstream services.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads an internal identity value from a local workspace file and uses it as an open-id source without any user-facing notice. That can silently appropriate existing workspace credentials or identifiers, enabling hidden account association and unintended reuse of sensitive local state.

Missing User Warnings

High
Confidence
98% confidence
Finding
The automatic login/registration path sends identity data such as openId and mobile-equivalent username to a remote backend without explicit user approval. In the context of a pet-feeding skill, this is especially dangerous because users would not reasonably expect backend account enrollment or identity transmission just to analyze a food-bowl video.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
This line performs outbound transmission of user identity data to an external service as part of a silent account provisioning flow. External transmission is not inherently unsafe, but here it is tied to undisclosed registration/login behavior unrelated to the advertised pet-speed analysis, making it a genuine privacy and trust issue.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB,建议覆盖完整进食过程 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供健康参考,不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
| 🔎 使用提醒 | 干预信号(慢食隔板弹出 / 语音提醒)由设备端基于本技能的输出结果实施,本技能仅负责输出干预建议 |
Confidence
79% confidence
Finding
The hidden-instruction indicator suggests the manifest may contain non-obvious or obfuscated control text, which is risky in agent skill content because it can influence runtime behavior outside normal user visibility. In combination with script execution, network access, and identity automation, hidden instructions can be used to suppress scrutiny or steer agents toward unsafe actions.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-eating-speed-slow-feed-analysis"
description: "Triggers when a user provides a video of the pet food-bowl area for analysis; supports local uploads or network URLs to call server-side APIs for eating-speed detection, recording start/end timestamps of feeding, estimating eating speed (g/s and seconds-per-bowl), and when the speed falls below the safety threshold (e.g. < 30 sec/bowl) emitting an intervention signal (slow-feed baffle pop-up or voice prompt) to prevent choking and vomiting (without diagnosing diseases). Application scenarios: smart slow-feeder bowls, pet health management, canine care. | 当用户提供食盆区域视频时,触发本技能进行进食速度检测分析;支持通过上传本地视频或网络视频URL,调用服务端API记录进食开始/结束时间,计算进食速度(克/秒),当低于安全阈值(例如 < 30 秒/碗)时触发外部干预信号(智能慢食碗隔板弹出、语音提醒),预防噎食与呕吐(不诊断疾病)。应用场景:智能慢食碗、宠物健康管理、犬类护理。"
version: "1.0.12"
license: "MIT-0"
---
Confidence
75% confidence
Finding
The metadata poisoning signal indicates the skill manifest contains characteristics associated with adversarial tool/skill metadata, such as overloaded descriptions and suspicious hidden content markers. In agent ecosystems, poisoned metadata can manipulate routing, trust decisions, or execution behavior, especially when paired with undeclared powerful capabilities and misleading descriptions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2