Pet Grooming Stress Behavior Analysis | 宠物美容过程应激行为识别

• Outcome: Review
• Latest audit: Aug 20, 2026 · 4:39 PM UTC
• Version: 1.0.9

Overview

The skill appears to do pet video analysis, but it also silently manages identities, creates or reuses accounts, stores tokens locally, and sends identity-linked data to remote services with weak user-facing control.

Review before installing. Use this only if you are comfortable sending pet videos or video URLs to the vendor service and having reports tied to an automatically managed identity. Avoid using it in workspaces containing sensitive smyx-api-key.txt values unless you intend that identity to be used, and be aware that auth tokens may be stored in the workspace data database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 76% confidence
• Finding: The list() method applies user-supplied filter keys directly via getattr(self.__model__, key) without validating that the key is an approved column name. While SQLAlchemy prevents classic SQL injection here, an attacker who can influence filters may trigger unintended attribute access, application errors, or query behavior against fields that should not be externally filterable, which becomes more concerning in a shared user/token DAO.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 76% confidence
• Finding: The count() method repeats the same unvalidated dynamic attribute lookup on caller-provided filter keys. In isolation this is not SQL injection, but it can expose internal model structure, cause denial-of-service through repeated exceptions, and permit querying on sensitive columns in a DAO that stores account and token-related data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to use shell, local file handling, network access, and likely environment-backed identity handling, yet the manifest does not declare permissions or clearly bound those capabilities. This creates a transparency and policy-enforcement gap where high-risk operations can occur without explicit user or platform review, increasing the chance of unintended data access or exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The CLI exposes a --list path that retrieves analysis history tied to an OpenID, even though the skill is presented as one-off video analysis. Because OpenIdUtil.resolve_current_open_id can resolve a supplied hidden open-id and the code then fetches history without any visible local authorization checks, this creates an access-control and privacy-risk surface if upstream controls are weak or misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: This file defines persistent local user/account storage logic that is unrelated to the declared pet grooming stress-video analysis purpose. In a skill context, collecting and retaining account records outside the expected functionality increases data-handling risk, expands attack surface, and can enable covert statefulness or user tracking if the broader system invokes it.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The User model stores personal profile data and especially token/open_token values inside a skill whose stated purpose is pet grooming video stress analysis. Persisting credentials or bearer-like tokens in a local SQLite database materially raises the risk of credential theft, unauthorized API access, and privacy violations, and the mismatch with the skill purpose makes this behavior more suspicious.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility module implements identity resolution, local user persistence, token caching, API-key file reads, and automatic authenticated request handling that go well beyond the stated pet-grooming video stress-analysis purpose. Hidden account and credential-management logic increases the risk of undisclosed data collection, cross-skill identity reuse, and unintended access to external services, especially because it is packaged as shared utility code rather than clearly disclosed application behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically registers or logs in a user through a /sys/phoneLogin endpoint using generated or reused identifiers, despite no clear connection to pet stress video analysis. This is dangerous because it silently creates or binds identities on a remote service, transmits user-linked identifiers, and persists returned tokens locally, which can expose users to unauthorized account creation, tracking, or service misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill repeatedly states that uploaded local files and remote URLs are processed by server-side APIs, but it does not present this as a clear user-facing privacy warning or consent boundary. Users may provide local videos or URLs without understanding that content will leave the local environment and may be retained or linked with cloud-side history queries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code reads an arbitrary local file and uploads its full contents to a server-side analysis API without any user-facing disclosure, confirmation, or visible data-handling notice in this path. Because this skill is designed to process videos from local uploads or URLs, users may unknowingly transmit sensitive footage or metadata off-device, creating a privacy and data-exfiltration risk if invoked on confidential files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill reads an API-key-related file from workspace storage to derive an internal identity value without any visible user notice or consent flow. This is risky because a seemingly unrelated grooming-analysis skill can silently repurpose locally stored credentials or identifiers, enabling undisclosed account linkage and external requests under a reused identity.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The HTTP request path transmits identity fields and authentication tokens, including openId, token values, and pnaUserName, without any user-facing disclosure in a skill whose advertised function is video stress recognition. This creates a privacy and security gap by sending account-linked data to external services beyond the minimum expected for analyzing a grooming video.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This POST sends identity-bearing data to an external endpoint as part of an automatic login/registration flow. In the context of a pet grooming stress-analysis skill, that external transmission is more dangerous because users would reasonably expect video processing, not silent account provisioning and disclosure of identifiers to a health-related service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2