Back to skill

Security audit

Pet Oral Snapshot & Gum Redness Recognition | 宠物口腔抓拍与牙龈红肿识别

Security checks across malware telemetry and agentic risk

Overview

The skill provides the advertised pet oral-image analysis, but it also under-discloses account-linked identity creation, cloud history access, and local token persistence.

Review this skill before installing if you are not comfortable with pet media being uploaded to lifeemergence.com services, account-linked history being queried from the cloud, and a local workspace database storing identity and token fields. Prefer installing only in a contained workspace and avoid using it with sensitive household images or shared agent accounts unless the publisher clarifies retention, authorization, and token handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill manifest advertises behavior that reads local files, writes outputs, performs network requests, accesses environment-derived identity, and invokes shell commands, yet it declares no explicit permissions or trust boundaries. This weakens reviewability and can cause an agent or user to approve a skill without understanding that uploaded files and URLs may be sent to remote services and that local execution is involved.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script exposes a hidden `--list` mode that retrieves prior analysis records keyed by internal identity, which expands behavior beyond the declared single snapshot analysis purpose. Because `open_id` handling is also present and the mode is not clearly disclosed, this creates a data exposure risk where historical pet health analysis records could be queried unexpectedly or by an unauthorized caller depending on downstream access controls.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The code comment claims internal identity is not user-provided, but the CLI accepts `--open-id` and passes it into `OpenIdUtil.resolve_current_open_id(...)`. This mismatch is dangerous because it can enable identity spoofing or insecure direct object reference behavior, allowing a caller to influence which user's records are accessed if the downstream resolver trusts that value.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The historical analysis listing capability goes beyond the manifest’s stated purpose of analyzing a user-provided oral image/video and may expose prior analysis records tied to an open_id. Even though this wrapper passes the current open_id, undocumented history access increases the risk of unintended data exposure and privacy violations if identity resolution or backend authorization is weak.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This service exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the stated pet oral-health analysis purpose. In a skill that is expected to analyze uploaded images or URLs for gum redness and tartar, these helpers enlarge the attack surface by enabling unrelated backend actions or requests if other parts of the skill pass user-influenced endpoints or payloads into them.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The module defines generic user-account persistence in a skill whose declared purpose is pet oral image analysis. That data-scope mismatch increases privacy and overcollection risk because identity records may be created, reused, or retained without being necessary for gum-color/tartar analysis.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores identity and authentication-related fields including username, real name, email, token, and open_token, none of which are justified by the stated oral-health observation function. Storing tokens in a local SQLite database broadens compromise impact: if the file is accessed, attackers may obtain credentials or impersonation artifacts in addition to personal data.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility provisions, resolves, and persists user identity state for the current workspace, including generating default open IDs and storing or reusing identity-linked values. That capability materially exceeds a pet oral image analysis skill's stated purpose and creates hidden account/identity handling that could tie user actions to backend services without clear consent.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can silently auto-register or log in a user against a separate health service endpoint using synthesized identity fields, then retrieve tokens for subsequent use. For a pet oral snapshot analysis skill, this is unjustified cross-service account activity and could create unauthorized accounts, leak identifiers, or enable backend actions under a user-linked identity.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The HTTP helper embeds payment and recharge workflow messaging unrelated to oral-health observation, indicating the skill can drive users into a billing flow outside its declared scope. While not a memory-safety flaw, this is a deceptive capability-expansion issue that can manipulate users and obscure what external services the skill is actually coupled to.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger rules are broad and include a default auto-trigger for common pet-mouth imagery submissions, which can cause the skill to run without clear, context-specific user consent. In this skill, activation can lead to local file handling and transmission of media or URLs to server-side APIs, so over-triggering increases privacy and unintended data-sharing risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill describes server-side analysis but does not present a clear user-facing warning that local files and supplied URLs are sent to cloud APIs, nor that history queries fetch cloud-stored reports. This reduces informed consent for potentially sensitive media and metadata, especially because the skill handles images/videos and auto-associated historical records.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
Sensitive identity resolution occurs automatically with little user-facing disclosure, while the skill processes pet health-related analysis data and may access historical outputs. Hidden or opaque identity handling increases privacy risk and makes it harder for users and integrators to understand when account-linked data is being used or retrieved.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill reads arbitrary local file content and sends it to a server-side analysis API, but this code provides no notice, consent flow, or restriction beyond extension/size checks. In a pet-health context, uploaded media may contain sensitive household or metadata content, so silent transmission increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script accepts a hidden API key parameter for a network-backed operation without user-visible disclosure, which obscures the fact that data may be sent to a remote service under credentialed access. In a pet oral snapshot context, this is more sensitive because uploaded local files or URLs may contain user-generated media and metadata, and the hidden credential path reduces transparency and auditability.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The HTTP helper assembles and transmits identity and credential material, including tokens, API keys, usernames, and tenant metadata, to remote services as part of routine requests. In the context of a pet oral-analysis skill, hidden outbound transmission of account-linked data is disproportionate to the stated functionality and increases privacy, misuse, and unauthorized backend access risks.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code reads identity-like data from an environment variable and a local secret-like file to determine the active open ID, then reuses it automatically. This hidden identity sourcing can cause unintended account linkage and silent use of locally stored identifiers, which is risky given the skill's narrow stated purpose of pet oral observation.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
98% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2