Security audit
Security checks for vulnerabilities and agentic risk
The skill broadly matches its pet-video analysis purpose, but it sends sensitive indoor footage to remote services while silently creating/reusing an identity and persisting account tokens/history state.
Install only if you are comfortable sending indoor camera videos or supplied video URLs to the publisher's remote services, allowing the skill to create/reuse an internal account identity, and storing authentication/history state in the workspace data directory. Prefer explicit confirmation before analysis or history queries, and avoid using private home footage unless the publisher's privacy and retention terms are acceptable.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
Identity generation/persistence, token acquisition, login/registration flows, and generic HTTP request capability materially exceed the declared function of analyzing pet-safety videos. These hidden account and authentication behaviors can enable tracking, unauthorized persistence of user identity, and expanded remote access without clear user awareness.
A metadata-poisoning indicator in the manifest suggests malformed or suspicious description content that may interfere with tool interpretation, policy enforcement, or review tooling. Even if accidental, anomalous metadata in a skill manifest is dangerous because it can obscure true behavior and weaken automated trust boundaries.
---
name: "smyx-pet-pica-behavior-recognition-analysis"
description: "Triggers when a user provides an indoor camera video for analysis; supports local uploads or network URLs to call server-side APIs for pet pica-behavior recognition, detecting contact between the pet's mouth and non-food hazardous items (electric wires, plastic bags, socks, tissues, toy fragments, etc.); when the contact lasts ≥ 2 seconds, outputs a warning signal to help prevent intestinal obstruction, electric shock and other dangers (without diagnosing diseases). Application scenarios: indoor cameras, pet safety monitoring, smart-home security. | 当用户提供室内监控�
The User model stores identity and authentication-related fields such as username, realname, email, token, and open_token, none of which are justified by a pet pica-behavior recognition workflow. Retaining these values in a local SQLite database creates unnecessary exposure of sensitive user data and tokens, potentially enabling account misuse or privacy harm if the workspace is accessed by other components or an attacker.
The utility code automatically resolves or creates persistent user identities, performs login/registration flows, retrieves tokens, and stores them locally, which is unrelated to pet pica video analysis. This creates hidden account linkage and credential handling behavior that can transmit and persist identity data without a clear functional need, increasing privacy and account-abuse risk if the skill is installed or reused broadly.
The skill declares no explicit tool scope or permissions despite clearly directing use of shell execution, network access, local file handling, and likely environment/state access. This creates an authority mismatch where reviewers and users cannot accurately understand what the skill is allowed to do, increasing the risk of over-privileged execution and abuse through attached scripts.
The skill says it uses server-side/cloud APIs but does not prominently warn users that uploaded local videos or supplied URLs will be transmitted off-device for analysis and history queries. For indoor camera footage, this omission is significant because the media may contain highly sensitive household, location, and behavioral information.
The default trigger is broad enough to activate whenever a user provides an indoor monitoring video for analysis, even if they did not ask for pet pica detection specifically. Over-broad triggering can cause accidental transmission and analysis of sensitive home-surveillance footage without sufficiently specific user intent.
The script exposes a hidden record-listing path via --list and show_analyze_list(open_id) that is outside the declared purpose of analyzing a supplied video. Because it retrieves historical analysis data tied to an internal identity, it expands the data access surface and can leak prior user records without clear user awareness or purpose limitation.
The code resolves an internal open_id even though the primary function is video analysis, and then uses that identity for record access. Hidden identity binding can enable silent correlation of user activity and unauthorized access to stored analysis history, especially if the identity source is implicit or manipulable.
OpenIdUtil.resolve_current_open_id(...) initializes a hidden identity without clear user disclosure, creating covert state about who is being acted on. In a skill that handles indoor camera video and historical analysis records, undisclosed identity resolution increases privacy risk and can enable access or linking of sensitive monitoring data beyond the immediate request.
The manifest describes a narrowly scoped skill that detects pet mouth contact with hazardous non-food items and emits a warning when contact lasts at least 2 seconds. However, the output-processing logic is generic: it unwraps arbitrary "commonAiResponse" and "healthAiResponse" payloads and generates a generic structured report plus export link, with no code enforcing or reflecting the stated pica-specific warning condition.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill accepts either a local file or arbitrary remote video URL and transmits that content to a server-side analysis API, but this file shows no visible consent notice, destination disclosure, or URL restriction. In a privacy-sensitive context involving indoor camera footage, this can lead to unintended disclosure of sensitive household imagery or server-side fetching of untrusted URLs with privacy and SSRF-adjacent risk depending on backend behavior.
This Python file performs multiple outbound HTTP requests, including sending parameters and arbitrary request bodies, but contains no docstrings, comments, logging, or confirmation prompts that disclose this network transmission behavior. For code files, network calls that may transmit user or system data should have some visible warning or explanation unless the behavior is clearly disclosed elsewhere.
This file exposes broad generic CRUD and transport helpers (add, edit, delete, http_get/http_post/http_put/http_delete, get_user_by_username) that are not narrowly scoped to pet pica video analysis. In a skill whose stated purpose is limited to analyzing pet-camera video for hazardous chewing behavior, this unnecessary general-purpose network surface increases the chance of unauthorized data access, unintended remote actions, or reuse by other code paths for behavior outside the declared scope.
The delete method performs a remote HTTP POST to carry out a deletion action, but this file provides no confirmation, warning comment, or user-visible disclosure that the operation may be destructive or irreversible. Under the code-file criteria, destructive operations should have some visible warning unless clearly documented as the skill's expected purpose.
Detected: suspicious.install_untrusted_source