Security audit

Pet Pica Behavior Recognition | 宠物异食行为识别（啃咬电线/塑料）

Security checks across malware telemetry and agentic risk

Overview

This pet-video analysis skill is mostly purpose-aligned, but it silently creates or reuses user identity data and cloud-linked history access in ways users may not understand before installing.

Review before installing. Use only with videos you are comfortable sending to the configured analysis service, and assume reports may be associated with a persistent local or remote identity. Check the service endpoint configuration, retention practices, and whether data/smyx-api-key.txt or the local SQLite database could link analyses to an account.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 72% confidence
Finding: The list() method applies filters using getattr(self.__model__, key) where key comes from the caller. Although this does not look like SQL injection because SQLAlchemy parameterizes values, it can still expose unintended model attributes, trigger exceptions for invalid keys, and allow callers to query on sensitive columns that the API may not have intended to expose. In this skill context, the DAO is generic and likely reused across components, which increases the chance that untrusted filter dictionaries reach it.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 72% confidence
Finding: The count() method repeats the same caller-controlled dynamic attribute lookup pattern as list(). While not classic SQL injection, it can enable unauthorized probing of model structure or counting records by sensitive fields and can cause denial-of-service via repeated invalid-key exceptions if exposed through higher-level APIs.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill manifest documents capabilities to read/write local files, access the network, inspect environment-linked identity state, and invoke shell commands, but does not declare permissions or present user-visible authorization boundaries. That creates a transparency and least-privilege problem: an agent could process local media, persist it, and send it to remote services without the permission model clearly reflecting those behaviors.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script includes a hidden `--list` mode that retrieves prior analysis records via `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the stated single-video analysis behavior. In a pet-monitoring/smart-home context, prior analysis history can reveal sensitive behavioral, household, or surveillance metadata, and the feature is not clearly disclosed to users.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script exposes a history-listing function via `--list` that retrieves prior analysis records using an `open_id`, but this capability is not disclosed in the skill description. Undocumented access to historical results increases privacy risk because users may trigger or receive data beyond the expected single-video analysis scope, especially if identity handling or authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The code resolves and uses a user identity (`open_id`) even though the manifest presents the skill as simple video analysis. Collecting or binding identity without clear disclosure expands the data footprint and can enable account linkage, history access, or correlation of uploaded videos with a specific user, creating avoidable privacy exposure.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The utility creates and persists synthetic user identities, and can source identity material from a workspace file unrelated to the pet-video analysis function. This expands the skill's behavior into covert identity management and account linkage, which can enable unauthorized account creation, hidden attribution of actions, and privacy violations across skills or users.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The HTTP helper silently performs registration/login via /sys/phoneLogin when tokens are absent, despite the skill being described as pet pica video analysis. This hidden side effect can create or reuse remote accounts without informed consent and attach outbound activity to a synthesized identity, making the skill materially more dangerous than its stated purpose.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that local files or remote URLs are sent to server-side APIs for analysis, but it does not clearly warn users that uploaded indoor camera footage may leave the local environment and be processed by a cloud service. Because the content is indoor surveillance video, this can expose sensitive household, location, and behavioral data beyond what a user may reasonably expect.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow says uploaded attachments are automatically saved as local files, but it does not warn users that their media will be stored on disk. Silent local persistence increases the risk of unintended retention, later unauthorized access, and accumulation of sensitive camera footage on the host system.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill mandates direct cloud API retrieval of history reports linked to an internal identity, yet does not clearly warn users that remotely stored user-associated report data will be queried and displayed. That can reveal previously collected surveillance-derived records without informed user awareness about remote storage and account linkage.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The API documentation describes exporting complete reports and triggering smart-home/device alerts based on indoor camera analysis, but it provides no privacy, consent, retention, or downstream sharing warnings. In the context of home surveillance and pet-monitoring video, this increases the risk of exposing sensitive household footage and derived behavioral data through report export or device integrations without adequate safeguards.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script resolves an internal user identity through `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` while suppressing the related CLI help for `--open-id`. Hidden identity handling is risky because it can silently bind actions and history retrieval to a user identifier without informed consent, and may enable cross-user data access if identity resolution or defaults are weak.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code accepts either a local file path or an arbitrary remote URL and forwards the video content to a server-side analysis API, but this file contains no user-facing notice, confirmation, or consent check before transfer. Because the skill is intended for indoor camera footage, the data can be highly sensitive and may expose private home interiors, occupants, and network-reachable resources to external processing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script supports hidden `--api-key` and configurable `--api-url` parameters while sending local file paths or remote URLs to a backend analysis service, yet provides no meaningful user-facing warning about credential use or remote processing. In this skill’s context—indoor camera footage of a home and pets—silent network transmission can expose highly sensitive household video and metadata to external services without informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Debug mode enables verbose HTTPConnection and urllib3 logging, which can expose full request and response contents including tokens, identifiers, URLs, and potentially user-supplied video metadata. In a smart-home pet monitoring context, these logs may contain sensitive household surveillance data and authentication material.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code reads data/smyx-api-key.txt to derive an internal identity value without any visible disclosure or consent. Using an API-key-related local file as an identity source can unexpectedly bind user actions to credentials present in the workspace and creates a hidden trust channel unrelated to the advertised pet-analysis workflow.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The request utility automatically sends external HTTP requests containing identity and authentication headers such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName. Because this is a shared helper for a pet-monitoring skill handling indoor camera content, undisclosed outbound transmission materially increases privacy and credential-exposure risk.

External Transmission

Medium

Category: Data Exfiltration
Content: "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"):
Confidence: 95% confidence
Finding: This code transmits identity-bearing registration/login data to an external endpoint using requests.post, including openId and mobile fields. In the context of a pet pica video analysis skill, this outbound account-provisioning request is outside user expectations and can expose personal or synthetic identity information to a remote service.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2