ClawHub
Back to skill

Security audit

Pet Hospital Waiting Anxiety Level Analysis | 宠物医院候诊焦虑等级评估

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised pet video analysis, but it also silently creates or reuses identities, stores tokens locally, and can query cloud history reports with broad triggers.

Review before installing, especially in clinics or workflows with client/staff footage. This skill may upload videos or video URLs to remote services, silently create or reuse an identity, store auth tokens in a local SQLite database, and query prior cloud reports without an explicit confirmation step.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
86% confidence
Finding
This method accepts arbitrary filter keys and resolves them with getattr(self.__model__, key) without validating that the field is intended to be queryable. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still query on unexpected columns such as token, open_token, del_flag, or internal metadata, which can enable unauthorized enumeration or bypass of business restrictions if this generic DAO is exposed through higher layers. In a multi-skill/shared-database context, generic unrestricted filtering is more dangerous because it increases the chance that one component can probe sensitive records created by another.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
The count() method repeats the same unrestricted dynamic field selection pattern as list(), allowing callers to test arbitrary columns by name. Even without SQL injection, this can leak information through record counts and support reconnaissance on sensitive attributes or deleted/internal records when used from untrusted inputs. The skill's shared local database design slightly increases exposure because a broadly reusable DAO may be consumed by multiple components with different trust assumptions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no explicit permissions while its instructions and examples require shell execution, local file handling, network access, and likely environment/config use. This mismatch undermines security review and consent boundaries, because an agent may exercise more powerful capabilities than the manifest transparently communicates.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation broadens the input scope from the stated video-analysis use case to include images and image files. Scope expansion increases the chance that agents process unexpected user data or route additional media types to backend services without clear approval, weakening input validation and user expectations.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill adds a cloud history-report retrieval feature that is outside the manifest's advertised analysis purpose. Hidden or under-declared secondary behaviors are dangerous because they can expose previously stored user-linked data and cause the agent to access remote records the user did not clearly expect.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The documented endpoints and scene code describe a general pet health analysis/reporting service, which is broader than the declared skill scope of waiting-area anxiety analysis from pet videos. This mismatch can enable scope expansion, causing the skill or its operators to access, expose, or process unrelated health-analysis data and report exports beyond the user's expected consent boundary.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script exposes a `--list` mode that retrieves prior analysis results by `open_id`, which goes beyond the declared purpose of analyzing a user-supplied video or URL. In a medical or quasi-medical workflow context, history/listing functionality can expose previously analyzed pet data or associated user records if access control in downstream components is weak or misconfigured, increasing privacy and data-minimization risk.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill exposes report-list retrieval and export-link generation functionality that goes beyond the stated single-video anxiety-analysis flow. In the absence of clear access control checks in this file, this can enable unintended enumeration of prior analysis records and access to exported report artifacts, increasing privacy and data-exposure risk for uploaded pet hospital videos and derived reports.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes broad generic request primitives and CRUD-style wrappers (add, edit, delete, http_get/post/put/delete) that are not scoped to the stated purpose of pet anxiety video analysis. In an agent-skill context, such unnecessary network capabilities increase the attack surface and could be repurposed to access or modify unrelated backend resources if other parts of the skill can influence the target URLs or payloads.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The get_user_by_username helper introduces user-enumeration or account-lookup functionality that is unrelated to analyzing pet waiting-area videos. Even if not directly exploited here, embedding identity-related lookup capability in this skill broadens access beyond its declared purpose and may enable privacy-sensitive queries or misuse of shared backend services.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility implements identity resolution that reads a workspace API-related file, reuses prior local identities, and creates persistent default user identities unrelated to the declared pet video anxiety-analysis function. That is a capability expansion into account/identity management and persistence, which can silently track users across sessions and cause undisclosed use of backend services under generated or reused identities.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The HTTP helper automatically logs in or registers users via /sys/phoneLogin, populates tokens, persists them locally, and injects identity headers into later requests. For a skill advertised as video anxiety scoring, this is materially beyond expected behavior and enables undisclosed account creation, token handling, and backend impersonation/activity under a silently selected identity.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code enumerates agent workspace structure, derives roots from file paths/environment variables, and creates shared data/skills directories. In the context of a narrowly scoped pet video analysis skill, this broad workspace discovery and filesystem manipulation increases access scope and can facilitate cross-skill data access, persistence, or unwanted installation side effects.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases for history lookup are broad enough to fire on ordinary discussion about reports or anxiety assessments. Over-broad triggers can cause unintended cloud queries and disclosure of historical report metadata when the user may only be asking a general question, especially because the skill says queries must directly call the API.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill accepts uploaded files and external URLs for server-side processing but does not clearly warn users that their content will be sent to remote APIs/cloud services. In this context, pet hospital waiting-area media may contain sensitive images of clients, staff, or identifying clinic details, so silent transmission creates meaningful privacy and compliance risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script accepts either a local video path or remote URL and passes it to a server-side analysis function without any visible consent prompt, notice, or restriction explaining that user-supplied media or references may be transmitted to an external service. In this skill’s context, the videos are from pet hospital waiting areas, which may contain sensitive operational footage, client information, or incidental human subjects, so silent transmission creates a real privacy and compliance risk even if the behavior is part of intended functionality.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
These helpers open files for writing and create directories with no user-facing notice, approval, or policy checks. In isolation this is common utility behavior, but within this skill it contributes to silent local persistence that users would not reasonably expect from a video anxiety-analysis feature.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads data/smyx-api-key.txt to derive an internal identity value without clear disclosure. Reading local API/identity-related files can expose or repurpose sensitive credentials/state and is not obviously necessary for analyzing a pet waiting-room video.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This request path transmits user identifiers and authentication headers to external services during normal execution, while also enriching request bodies with username and platform metadata. Because this happens transparently inside a shared utility, users invoking a pet video analysis skill may unknowingly send identity-linked data off-host, creating privacy and account-security risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
The code posts registration/login data, including openId/mobile/source fields, to an external endpoint. External transmission is expected for some cloud-backed skills, but here the transmitted identity bootstrap data is unrelated to the stated pet-video analysis purpose and occurs without clear user awareness, making it a real privacy/security concern rather than a benign network call.

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🔎 使用提醒 | 拍摄角度建议正面或侧前方，覆盖头部与躯干；避免逆光、剧烈晃动或宠物完全被笼具遮挡 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供候诊流程参考，不提供疾病诊断或治疗方案 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 🔎 使用提醒 | 焦虑等级综合多种行为信号估算，宠物个体差异、品种特性（如短鼻犬天然喘气重）可能影响判断，临床决策请结合现场观察 |
Confidence
74% confidence
Finding
The hidden-instructions indicator suggests non-obvious control content embedded in the document, which is risky in agent skills because concealed directives can influence tool use or bypass reviewer expectations. Combined with mandatory API usage, automatic identity handling, and broad triggers elsewhere in the file, any hidden control text increases suspicion and reduces auditability.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-hospital-waiting-anxiety-analysis"
description: "Triggers when a user provides a pet hospital waiting area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for anxiety-related behavior recognition, detecting open-mouth panting intensity, limb/torso trembling amplitude, ear-flattening degree and other stress signals, outputting a standardized anxiety level (1-5) to help medical staff identify high-stress pets and prioritize care or comfort (without diagnosing diseases or prescribing treatment). Application scenarios: pet hospital waiting areas, veterinary clinics, pet care institutions. Development reason: optimize visit workflow and reduce stress-related harm. | 当用户提供候诊区宠物视频的URL或文件时，触发本技能进行焦虑行为信号分析；支持通过上传本地视频或网络视频URL，调用服务端API检测张口喘气强度、四肢/躯干颤抖幅度、耳朵后贴程度等应激信号，综合输出标准化焦虑等级（1-5级），帮助医护人员识别高应激宠物并优先安排就诊或安抚（不诊断疾病、不提供治疗方案）。应用场景：宠物医院候诊区、动物诊所、宠物护理机构。"
license: "MIT-0"
---
Confidence
81% confidence
Finding
The YARA hit for tool/metadata poisoning is credible here because the manifest description is overloaded with operational instructions and mixed-language content, while the skill also introduces undeclared capabilities and hidden-instruction indicators. Metadata that shapes agent behavior beyond simple description can manipulate routing or trust decisions, causing the agent to perform unexpected networked actions or data retrieval.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2