Pet Hospital Waiting Anxiety Level Analysis | 宠物医院候诊焦虑等级评估

• Outcome: Review
• Latest audit: Oct 3, 2026 · 7:58 PM UTC
• Version: 1.0.15

Overview

This skill performs the stated cloud video analysis, but it also silently creates or reuses an identity, stores service tokens locally, and can query cloud report history automatically.

Review before installing. Use this only if you are comfortable sending pet clinic media and URLs to the configured external service, allowing the skill to create or reuse an internal identity, storing service tokens in the workspace data directory, and retrieving cloud report history without a separate confirmation step.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated remote API access, token/header injection, local identity generation, workspace secret reads, DAO persistence, and account/payment handling are highly sensitive capabilities that do not belong in an ostensibly simple pet-anxiety analysis skill unless clearly justified. This combination materially increases the risk of secret exposure, identity misuse, and undisclosed account linkage under a misleading manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description indicates that local files or URLs may be sent to server-side/cloud APIs, but it does not prominently warn users that their provided media will leave the local environment. Because videos from hospital waiting areas can contain sensitive or identifying content, undisclosed external transmission is a significant privacy and compliance concern.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-pet-hospital-waiting-anxiety-analysis"
description: "Triggers when a user provides a pet hospital waiting area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for anxiety-related behavior recognition, detecting open-mouth panting intensity, limb/torso trembling amplitude, ear-flattening degree and other stress signals, outputting a standardized anxiety level (1-5) to help medical staff identify high-stress pets and prioritize care or comfort (without diagnosing diseases or prescribing treatment). Application scenarios: pet hospital waiting areas, veterinary clinics, pet care ins

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises and documents capabilities that imply shell execution, network access, local file handling, and environment usage, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege guarantees and makes it harder for a host system to constrain what the skill may access, especially given the instructions to run local scripts and process user-supplied URLs/files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation broadens the skill from video anxiety analysis to image analysis and cloud history retrieval, which are materially different data flows and capabilities. Scope drift like this increases the chance of unreviewed processing paths and unexpected handling of additional user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Overly broad trigger phrases for history-report queries can cause unintended invocation of cloud-backed functionality based on ambiguous user text. That can expose report metadata, create privacy issues, or trigger unnecessary remote actions when the user did not clearly request them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that uploaded attachments are automatically saved locally but does not provide a prominent user-facing warning about storage, retention, or location. Silent persistence of user-provided media is a privacy and operational risk, especially for recordings from clinics or waiting rooms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic creation and reuse of a default local user identity is not necessary for the stated purpose and can silently associate multiple actions or reports to a hidden account. In a healthcare-adjacent workflow, hidden identity binding increases privacy, auditability, and consent risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented endpoints materially exceed the skill’s declared scope of one-off waiting-area pet anxiety analysis by including broad health-analysis, history lookup, and report export functionality. This creates an over-privileged integration surface that could enable access to unrelated pet health data or reports if exposed through the skill, increasing data exposure and unauthorized use risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

History query and full report export capabilities are not necessary for transient triage-oriented anxiety assessment and imply retention and retrieval of potentially sensitive animal health records beyond the user’s immediate request. If wired into the skill, these endpoints could be abused to enumerate past analyses or export complete reports, expanding the privacy and data leakage impact well beyond the advertised function.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The only code documentation in this file says the package is for 'Pet Waste Characteristic Recognition Analysis', which contradicts the manifest's stated purpose of pet hospital waiting-area anxiety/stress video analysis. This is an active intent mismatch in documentation rather than a mere omission, because it describes a different analysis domain entirely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The --list path calls show_analyze_list(open_id) which in turn invokes skill.get_output_analysis_list(open_id=open_id), exposing a history of analyses that is broader than the narrowly described waiting-area anxiety assessment function. In a veterinary setting this can leak prior pet health-related records or metadata tied to an internal identifier, creating an unauthorized data exposure risk if the current user did not explicitly request or consent to historical retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code silently resolves an internal identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) while suppressing the --open-id help text, meaning identity binding occurs without clear disclosure to the operator. Hidden identity resolution is dangerous because it can cause analysis history retrieval or data association under an internal user identifier without informed consent, and can facilitate unintended cross-user data access if identity resolution is mis-scoped.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-visible strings such as 分析报告结构化结果, 获取报告导出图片链接, and other status/error messages are hard-coded in Chinese. The file does not offer a user opt-in for language selection or document that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code reads the entire local file into memory and sends it to a server-side analysis API, and it also accepts arbitrary remote video URLs for server-side fetching. In a pet hospital context, uploaded videos may contain sensitive personal or operational information, so transmitting them without any in-code consent, disclosure, or minimization controls creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2