Security audit
Security checks for vulnerabilities and agentic risk
This cloud pet-video analyzer needs review because its export-only mode still permits analysis and its account credentials are handled without adequate safeguards.
Before installing, ask for a working export-only mode, credential restrictions to approved HTTPS services, and clear account-storage and deletion controls. Selected footage leaves your device for Life Emergence cloud processing; confirm its privacy and pricing terms before using household recordings.
The visible implementation is generic scaffolding with a nonfunctional chat helper, rather than the declared pet-health monitoring capability. It does not actually execute the commented-out agent command. Imported base classes and services are not supplied, so their behavior cannot be assessed; this finding is limited to the provided chunk.
The supplied chunk centers on user-account persistence rather than video analysis, pet-health indicators, anomaly detection, or report generation. Database storage can be a legitimate supporting implementation detail, but this chunk specifically manages user identities and token fields and shows no connection to the declared monitoring workflow. No network transmission or token harvesting is demonstrated. This assessment is limited to the supplied chunk.
The reported attachment of API keys and authentication tokens to unrestricted caller-supplied absolute URLs would allow credential disclosure to an attacker-controlled destination. Automatic account initialization makes credentials available without an explicit login step; however, the underlying request code is not included here, so this conclusion rests on the static finding's implementation description rather than direct verification.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "pet-health-monitoring-analysis"
description: "Based on computer vision, analyzes pet health indicators such as feeding frequency, drinking frequency, excretion status, mental state, vomiting behavior, and limping abnormalities through camera/feeder monitoring videos, promptly detects abnormal pet health conditions, and outputs health monitoring reports. | 宠物日常健康监测分析技能，基于计算机视觉通过摄像头/喂食器监控视频分析宠物的进食频次、饮水频次、排泄状态、精神状态、呕吐行为、跛行异常等健康指标，及时发现宠物异常健康状况，输出健康监测
The helper accepts arbitrary absolute HTTP or HTTPS URLs and automatically attaches X-Access-Token, X-Api-Key, and Authorization without checking the destination. If an untrusted URL reaches this helper, an attacker-controlled server can receive service credentials and user identifiers; HTTP destinations also expose them in transit. A video-analysis skill may legitimately handle external resource URLs, making separation between resource fetching and authenticated API calls especially important, although such a call path is not shown here.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow automatically processes attachments through an external service without an explicit privacy warning or authorization checkpoint for that disclosure. Home-monitoring recordings can reveal people, conversations, household routines, and private interiors beyond the pet-health information the user intends to analyze.
The parser documents --export-env-only as not executing analysis, but main() never checks this flag and proceeds to analyze_video() when an input or URL is supplied. This violates an explicit no-analysis expectation and could trigger unintended remote processing, disclosure of private household monitoring footage, or API charges; the exact transmission behavior depends on the unavailable skill implementation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The code reads the selected local video into memory and passes its contents to the analysis API without any visible upload disclosure or consent gate. Pet-monitoring footage can expose household interiors, occupants, and daily routines, making undisclosed remote processing a privacy risk even though video analysis is the skill's intended function. The API destination and any upstream consent controls are not shown, so this is not evidence of malicious exfiltration.
The --export-env-only option promises not to execute analysis, but args.export_env_only is never checked; supplying it with --input or --url still invokes skill.get_output_analysis. This violates an explicit no-analysis boundary and could trigger unintended processing or transmission of private household monitoring footage, although the downstream implementation is not shown.
The User model stores human identity and demographic information, including real names, email addresses, birthdays, sex, and age, alongside token and open_token credentials. UserDao exposes inherited CRUD operations for these records, and DAO initialization creates and migrates the user table (L184–L215); this account-management capability is not justified by the manifest's video-based pet-health monitoring and reporting scope.
The docstring at L26 says this method invokes the OpenClaw agent through subprocess and L33–L34 promise an analysis result or session ID. However, the command and subprocess invocation are commented out; L68 creates an empty dictionary, and accessing result.stderr at L70 raises an exception that is caught, causing the method to return None without performing analysis.
The generically named open helper uses write mode, which immediately erases an existing file's contents even before anything is written. There is no confirmation, explanatory comment or docstring, or user-facing message disclosing this behavior; exception handling does not disclose successful truncation.
When authentication tokens are missing, the request helper invokes /sys/phoneLogin with silent=1 and register=1, then saves the returned user and tokens through UserDao. This introduces automatic account provisioning and persistent identity management beyond the manifest's stated video-analysis and health-reporting behavior; it is more than merely calling an analysis API.
The authentication helper posts the supplied identity as both openId and mobile to the health-service login endpoint, with silent and register enabled. It is invoked automatically when tokens are missing, but has no explanatory comment, docstring, confirmation, or user-facing log disclosing this additional identity transmission and potential registration.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
YamlUtil.load creates parent directories and writes a YAML file when the requested path does not exist, without a comment, docstring, prompt, or user-facing log disclosing this side effect. Unlike an explicit save operation, this write is unexpected for a loader and can occur during module import through BaseEnum.init_subclass (L044–L059).
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
elif isinstance(cur, dict):
cur = cur.get(part, default)
else:
cur = getattr(cur, part)
return cur
except Exception:
return default