Pet Eating Speed Slow Feed Analysis | 宠物进食速度检测与慢食干预

• Outcome: Review
• Latest audit: Oct 2, 2026 · 1:36 AM UTC
• Version: 1.0.13

Overview

The skill is not overtly destructive, but its cloud identity, token storage, and history-report access are broader and less clearly controlled than a pet-video analysis user would expect.

Review before installing. Use it only if you are comfortable sending pet-feeding videos or URLs to lifeemergence.com services, associating analysis and history reports with an internal user identity, and allowing a local workspace database to store account tokens. Prefer a separate workspace/account and confirm the provider's privacy, retention, and deletion practices first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch is that the skill claims simple pet video analysis but reportedly reads/writes local files, discovers workspace paths, reads API key material, creates default identities, manages local users/tokens, logs into remote APIs, and performs generic HTTP methods with polling/debug logging. This is dangerous because it combines credential handling, identity creation, persistence, and unrestricted remote communication under a benign consumer-health label, materially increasing the risk of secret exposure, unauthorized account actions, and unexpected data exfiltration.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-pet-eating-speed-slow-feed-analysis"
description: "Triggers when a user provides a video of the pet food-bowl area for analysis; supports local uploads or network URLs to call server-side APIs for eating-speed detection, recording start/end timestamps of feeding, estimating eating speed (g/s and seconds-per-bowl), and when the speed falls below the safety threshold (e.g. < 30 sec/bowl) emitting an intervention signal (slow-feed baffle pop-up or voice prompt) to prevent choking and vomiting (without diagnosing diseases). Application scenarios: smart slow-feeder bowls, pet health management, canine care. | 当用户提供食盆区�

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares powerful capabilities in practice (filesystem access, shell execution, environment access, network access) but does not explicitly scope or restrict them in metadata. This weakens reviewability and increases the chance that an agent will invoke the skill with broader privileges than users or platform policy expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description says local files or URLs are supported and server-side APIs are called, but it does not clearly warn users that media and linked resources may be transmitted, stored, or processed remotely. This undermines informed consent, especially for home videos and externally hosted URLs that may contain personal or location-sensitive information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The AI role instruction is written as a direct mandate in Chinese for how the assistant should operate, and the document does not state that users may choose their preferred language or that the skill is intentionally limited to a Chinese-speaking locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger rules include broad conversational keywords such as vomiting, eating too fast, or report-related phrases, which may activate the skill in contexts where the user did not intend remote analysis or history retrieval. In a skill that can access local files and cloud APIs, over-triggering increases the chance of unintended data processing and surprising side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hidden --list mode exposes functionality beyond the declared purpose of analyzing a provided video, allowing retrieval of a pet health analysis list tied to an open_id. Hidden or undocumented data-retrieval paths are dangerous because they expand access to potentially sensitive historical records without clear user consent, authorization checks, or manifest visibility.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill initializes and uses a hidden internal identity (open_id) even when performing operations not necessary for simple video analysis, creating a covert link between tool execution and user-specific records. In a pet-health context, this increases privacy risk because feeding and health-related analysis history may be associated with a user account and could be queried or acted on without transparent disclosure.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code accepts either a local file path or an arbitrary remote URL, then forwards the file bytes or supplied URL to a backend analysis service without any disclosure, confirmation, or visible consent handling in this file. Because the skill processes pet-feeding videos from a home environment, this can expose sensitive household imagery or cause users to submit third-party URLs without understanding that the content will be transmitted server-side.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script exposes a --list path that calls skill.get_output_analysis_list(open_id=open_id) to retrieve historical analysis records, even though the skill description only advertises per-video eating-speed analysis and intervention. This creates an undocumented data-access capability that may let users enumerate or retrieve prior feeding-analysis history tied to an OpenID, increasing privacy and authorization risk if access controls are weak or bypassable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This Python code performs outbound HTTP requests, including sending request parameters and payloads, but there are no user-facing warnings, logging statements, prompts, or explanatory comments indicating that user or system data may be transmitted. The same pattern appears across the generic request wrappers, making the network transmission behavior undisclosed within this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a narrowly scoped video-analysis skill for detecting pet eating speed and possibly triggering an intervention signal. This file exposes generic list/add/edit/delete and raw http_get/http_post/http_put/http_delete methods against caller-supplied URLs, enabling broad remote resource access and modification that is not justified by that stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The delete method invokes a POST request for a deletion action, which is potentially destructive or irreversible, but this file contains no confirmation prompt, warning, logging, or explanatory comment for that behavior. Because the method is explicitly named delete, users or integrators are not given any in-file disclosure about the impact of calling it.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2