Back to skill

Security audit

Pet Daily Health Monitoring & Analysis Tool | 宠物日常健康监测分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill largely does pet health video analysis as advertised, but it also silently creates or reuses an identity, stores authentication tokens locally, and queries cloud history without enough user control or disclosure.

Install only if you are comfortable sending pet monitoring media and identity-linked metadata to the listed cloud services. Before use, review or remove any workspace data/smyx-api-key.txt value, understand that a local SQLite user/token database may be created in the workspace data directory, and prefer explicit analysis and history requests rather than broad automatic triggers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill directs use of local files, shell execution, network access, and local writes, but declares no permissions or user-visible security boundaries. This creates a transparency and consent problem: an agent may execute code and transfer data in ways the user did not expect, especially for uploaded pet-monitoring media and report handling.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The documentation mandates automatic reuse or creation of a local default user identity, even when no user identity is supplied. That behavior is unnecessary for basic pet-video analysis and risks cross-user data mixing, silent account linkage, and retention of reports under an identity the current user never approved.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill expands from media analysis into cloud history retrieval, including mandatory API queries for historical reports. This broadens data access beyond the core task and can expose previously stored pet-monitoring reports or metadata without a narrowly scoped, clearly consented request path.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill’s declared purpose is pet health video analysis, but it also exposes an account-scoped history listing function via `show_analyze_list(open_id)` that is not necessary for the core task. Mixing analysis with account data retrieval increases the attack surface and can enable unintended access to prior analyses or metadata if identity handling is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code initializes internal identity/OpenId handling even though the skill’s stated purpose is only media analysis. Introducing identity resolution without a clear business need creates a risk of unauthorized access to account-scoped data, especially combined with the list functionality, and may allow the skill to act on or retrieve data in the context of the current internal user.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
This file exposes broad generic HTTP and CRUD wrapper methods (`add`, `edit`, `delete`, `http_get`, `http_post`, `http_put`, `http_delete`) that can call arbitrary URLs, which materially exceeds the declared pet-health video analysis purpose. In a skill environment, this creates an unnecessary capability expansion: if other skill components or prompts can influence the URL or request data, the skill can be repurposed for unauthorized API access, data exfiltration, or unintended side effects against internal or external services.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The `get_user_by_username` capability introduces user-account lookup behavior unrelated to pet health monitoring, increasing the skill's access to identity data without clear functional justification. Even if intended for convenience, this can enable account enumeration, privacy violations, or misuse of directory data when combined with broader API wrapper functions.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The file defines persistent user-account management behavior, including lookup and reuse of default users, which is outside the declared pet health video analysis function. Scope mismatch increases the risk of hidden data collection or privilege-bearing identity persistence, especially when combined with stored tokens and local database access.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores and updates identity and credential-like fields such as username, email, token, and open_token without any clear relation to pet health monitoring. In this skill context, that unexplained credential persistence materially raises privacy and account-compromise concerns because the data could be abused or exposed from the local SQLite database.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
This DAO implements generalized local database creation and CRUD persistence infrastructure rather than narrowly supporting pet-health video analysis or report generation. In isolation that is not inherently malicious, but in this skill context it expands storage and data-handling capability beyond the declared purpose, increasing the risk of silent retention of unrelated sensitive data.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs remote account provisioning, token retrieval/caching, and authenticated API request handling that are unrelated to the advertised pet-health video analysis function. This creates hidden identity, authentication, and outbound network behavior, increasing the chance of unauthorized account creation, silent data transfer, and misuse of workspace credentials under the guise of an unrelated skill.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code returns billing and skill-installation instructions when a 402 response occurs, including prompts to install another payment skill. For a pet-health monitoring skill, this is functionally unrelated and indicates hidden monetization or account workflow behavior that could manipulate users into broader ecosystem actions not expected from the stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill reads a workspace API-key file, falls back to local database state, and synthesizes a persistent default user identity when none is supplied. For a computer-vision pet-health skill, creating and persisting hidden identities is unrelated to core functionality and can enable silent account linkage, attribution of actions to fabricated users, and undisclosed use of local secrets.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger conditions are broad enough to auto-activate on generic mentions of pet health topics or report history, increasing the chance of unintended execution. In this skill, unintended activation is more dangerous because execution may save files locally and query cloud APIs, potentially causing unnecessary data handling or disclosure.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill accepts local files and network URLs and states that an API service will download and process network resources, but it does not clearly warn users that pet-monitoring media and generated reports may be transmitted to and stored in the cloud. Because pet camera footage can contain sensitive household and behavioral data, lack of disclosure materially increases privacy risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill reads arbitrary local file contents and transmits them to an external analysis service without any visible consent, warning, or trust-boundary notice in this file. In a pet-health monitoring context, uploaded videos may contain sensitive household imagery or other personal data, so silent exfiltration of local files meaningfully increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The CLI triggers analysis by passing a local file path or remote URL to a backend service, yet there is no explicit notice, consent prompt, or disclosure that user-provided video data may be transmitted off-device. In a pet-health monitoring context, video can contain sensitive household, location, or behavioral information, so silent transmission creates a meaningful privacy and compliance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code automatically creates and stores a default open-id/user identity for later reuse without a clear user-facing prompt or disclosure. Silent identity creation can mislead users about what account is being used, complicate auditing, and cause actions or data to be associated with an account they did not knowingly establish.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The HTTP request wrapper automatically injects usernames, tenant identifiers, and authentication tokens into outbound requests, with no visible non-debug disclosure or consent path in this file. In the context of a pet-health analysis skill, this expands data transmission beyond expected video analysis behavior and risks covert sharing of identity-linked metadata with remote services.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
88% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB,建议视频时长不少于 1 小时以反映日常行为规律 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供宠物健康参考,不能替代专业兽医诊断,发现异常请及时就医 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📁 格式支持 | 当显示历史监测报告清单的时候,从数据 json 中提取字段  作为超链接地址,使用 Markdown 表格格式输出,包含" |
Confidence
83% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "pet-health-monitoring-analysis"
description: "Based on computer vision, analyzes pet health indicators such as feeding frequency, drinking frequency, excretion status, mental state, vomiting behavior, and limping abnormalities through camera/feeder monitoring videos, promptly detects abnormal pet health conditions, and outputs health monitoring reports. | 宠物日常健康监测分析技能,基于计算机视觉通过摄像头/喂食器监控视频分析宠物的进食频次、饮水频次、排泄状态、精神状态、呕吐行为、跛行异常等健康指标,及时发现宠物异常健康状况,输出健康监测报告"
version: "1.0.10"
license: "MIT-0"
---
Confidence
72% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2