Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised cloud video analysis, but it also silently creates or reuses an identity, stores tokens locally, and can query cloud history, so it needs user review before installation.
Install only if you are comfortable sending grooming media or URLs to the Lifeemergence/Open API services and allowing the skill to create or reuse a local identity, store service tokens in the workspace, and retrieve identity-linked historical reports. Avoid using it with sensitive shop, clinic, customer, or camera footage unless the publisher provides clear data retention, account, and deletion terms.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
The code behaviors described here—workspace file access, identity creation/reuse, token-managed authenticated HTTP requests, and remote login/auth endpoints—indicate privileged local and remote operations unrelated to simple pet stress scoring. In context, this is especially risky because the skill encourages processing user-provided files/URLs and silently associates them with internally managed identities.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-pet-grooming-stress-behavior-analysis"
description: "Triggers when a user provides a pet grooming session video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for stress behavior recognition, detecting struggling, panting, tail tucking and other stress signals during grooming, outputting stress level grading to help groomers intervene promptly. Application scenarios: pet grooming shop cameras, veterinary clinics, pet care services. | 当用户提供宠物美容过程视频URL或文件时，触发本技能进行应激行为分析；支持通过上传本地视频或网络视频URL，�
The HTTP helper silently performs phone-login/registration against a remote service and persists returned tokens into a local database. For a video stress-analysis skill, this is unrelated functionality that introduces covert account provisioning, credential storage, and remote identity linkage, increasing privacy and abuse risk if the host environment or database is later accessed.
The skill declares powerful capabilities in practice—shell execution, file read/write, environment access, and network use—yet provides no explicit tool-scope or permission boundaries in the manifest. This weakens policy enforcement and makes it easier for the skill to invoke sensitive actions beyond its stated pet-video analysis purpose, especially given the instructions to run local scripts and access cloud APIs.
The skill does not clearly warn users that uploaded files, URLs, and historical report requests are sent to server-side/cloud APIs. This is a privacy and transparency problem because grooming videos may contain people, locations, business interiors, or other sensitive data, and users may not realize they are authorizing remote processing.
The trigger conditions are broad enough to activate on common phrases about stress, reports, or grooming, which can cause unintended invocation of local scripts and cloud queries. In an agent setting, overbroad triggers increase the chance of accidental data transmission or unexpected use of sensitive capabilities without clear user intent.
This code hard-codes the command description, argument help text, and status/error messages in Chinese, which imposes a specific language on all users. The file provides no mechanism to select another language or to opt into this locale, matching the language-policy violation criteria.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill returns user-facing strings such as 分析报告结构化结果, 获取报告导出图片链接, and multiple Chinese error/status messages, indicating a fixed-language UX. The file does not offer language selection or explain that the skill is intentionally limited to Chinese users, which is a natural-language locale policy concern.
The skill reads arbitrary local file contents into memory and sends them to an external analysis API, but the code contains no user-facing disclosure, consent check, or trust boundary notice. In a skill that processes local uploads, this creates a real privacy and data-handling risk because users may not realize their local video is being transmitted off-host to a remote service.
The analysis flow sends user-supplied local paths or remote URLs into a backend analysis service without any clear disclosure that external processing occurs. In the context of pet grooming videos, this can expose sensitive footage, metadata, or internal resource URLs to a remote service without informed consent, creating privacy and potential SSRF-style risk if arbitrary URLs are accepted upstream.
The script exposes a history-listing function that retrieves prior analysis results via skill.get_output_analysis_list(open_id=...), which goes beyond the stated purpose of analyzing a user-provided grooming video. Undocumented access to historical records increases the risk of unauthorized data exposure, especially if callers can resolve or influence the identity used for lookup.
The code resolves a user identity and then uses CURRENT__OPEN_ID to fetch analysis history, introducing identity-linked data access that is not necessary for one-off video stress analysis. This creates a privacy and access-control risk because history retrieval may expose prior results tied to a user account if identity resolution is weak, implicit, or spoofable.
This file exposes broad generic network capabilities through CRUD-style wrappers and arbitrary http_get/http_post/http_put/http_delete methods, even though the skill is described as a narrowly scoped pet grooming stress-analysis integration. If higher-level skill code can pass user-influenced URLs or parameters into these helpers, the skill can be repurposed to contact unintended internal or external services, expanding the attack surface and enabling SSRF-like behavior or unauthorized API use.
This module creates a local SQLite database and exposes broad CRUD capabilities even though the skill description only justifies video submission and server-side stress analysis. Such extra persistence and generic data handling are dangerous because they enable collection and retention of unrelated data, make abuse easier in a compromised skill, and are disproportionate to the stated feature set.
The file defines persistent user-account storage including username, realname, email, token, and open_token fields, which is unrelated to a pet grooming stress-analysis skill that is described as processing video input via server-side APIs. Unnecessary credential and identity storage expands the attack surface, creates privacy risk, and increases the impact of any local database compromise.
Detected: suspicious.install_untrusted_source