Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised pet-media analysis, but it also silently creates or reuses a cloud-linked identity, stores tokens locally, and can query cloud history without clear end-user consent controls.
Review before installing. Use this only if you are comfortable with dog-toilet or walking-path media being sent to the provider's cloud APIs, a persistent local identity and tokens being created in the workspace, and cloud history being queried automatically when matching phrases are used. Do not use it for private household footage unless those data flows are acceptable.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The combination of persistent default identity generation, local user/token storage, remote login/registration, authorization retries, and generic API utilities is a major expansion beyond the declared pet-analysis use case. In practice this can create silent account creation, credential/token mishandling, cross-user data access, and long-lived tracking identifiers without informed user consent.
The YARA hit for metadata poisoning indicates suspicious manifest text patterns that can be used to manipulate tool interpretation, hide capabilities, or interfere with policy evaluation. Even if not intentionally malicious, malformed or adversarial metadata in a skill manifest is dangerous because orchestrators often trust manifest fields for routing, consent, and enforcement decisions.
---
name: "smyx-pet-stool-morphology-recognition-analysis"
description: "Triggers when a user provides an image/video URL or file of dog toilet area or outdoor dog-walking path for analysis; supports local uploads or network URLs to call server-side APIs for pet stool morphology recognition, analyzing stool color (brown, black, red, white), shape (formed, loose/soft, watery, granular hard), and the presence of blood or mucus, outputting standardized abnormal observation features to help early discovery of gastrointestinal diseases (without diagnosing diseases). Application scenarios: dog toilets, outdoor dog-walking path cameras, pet health monitoring
The HTTP helper automatically logs in or registers users against a health-service backend by sending openId/mobile values and then caching returned tokens. For a pet stool analysis skill, this is unrelated functionality that can covertly enroll users, link identities across systems, and cause authenticated backend activity without an explicit opt-in.
The skill advertises and instructs use of shell, network, file read/write, and environment-dependent behavior, but declares no explicit tool scope or permission boundaries. That creates an over-privileged, poorly governed execution model where a host agent may permit broader capabilities than users expect, increasing the chance of misuse or unsafe side effects.
The skill does not clearly warn users that uploaded files or supplied URLs may be sent to remote APIs and that attachments may be stored locally. This is a meaningful privacy and transparency problem because users may share sensitive home or location imagery without understanding where it goes or how long it persists.
The trigger logic is broad enough to activate on loosely related images/videos and health-monitoring keywords, which can cause unintended processing of user content. In a skill that uploads or analyzes media and accesses cloud history, overbroad triggering increases the chance of unconsented data transmission and incorrect tool invocation.
The script exposes a hidden --list mode that calls skill.get_output_analysis_list(open_id=...), which is outside the declared image/video stool-analysis behavior. Because it is paired with internal identity resolution, a user or caller may retrieve prior analysis history without clear disclosure or authorization checks in this file, creating a privacy and scope-expansion risk.
The call to OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) initializes an internal user identity without transparent user-facing disclosure. In combination with the hidden listing feature, this can enable access to user-linked data or records through implicit identity handling that the user did not knowingly authorize.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Multiple user-facing strings are hardcoded in Chinese, such as the report header and export-link text, with no indication that the skill is region-specific or that users can opt into another language. This can violate language/locale policy when a skill implicitly forces a specific language without user choice or justification.
The manifest says the skill triggers on image/video URLs or files for stool morphology analysis. In code, the user-facing validation and parameter mapping only mention and handle a local video path or network video URL, including sending remote inputs as videoUrl, with no corresponding image handling path shown in this file.
The code reads the entire local file into memory and sends it via self.analysis(...) for remote processing, but there is no confirmation prompt, print/log statement, or explanatory comment disclosing that file contents will be uploaded or transmitted. Because this is a code file, file/data transmission operations should have some visible user disclosure unless clearly warned elsewhere in the skill documentation.
The manifest says the skill analyzes dog stool images or videos and supports local files or URLs, but this file exposes only video-oriented operations: analyze_video, --input described as local MP4, --url described as network MP4, and a --list history function. There is no image-handling path or stool-specific logic in this script, so the documented scope is broader and more specific than the implemented behavior shown here.
The script sends user-provided media or URLs to a server-side analysis service without any explicit notice, consent flow, or clear disclosure of where the data is transmitted. In this skill's context, uploaded videos may capture a home environment, geolocation clues, or other sensitive household details, so silent external transmission materially increases privacy risk.
This code file issues outbound HTTP requests via RequestUtil.http_post/http_put/http_get/http_delete, including generic pass-through methods that may transmit caller-provided data. The file contains no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that network calls occur.
The manifest describes a narrowly scoped skill for analyzing dog stool images/videos via server-side APIs and returning morphology observations. This module instead exposes broad pagination, add, edit, delete, and generic HTTP GET/POST/PUT/DELETE methods against caller-supplied URLs, plus user lookup, which are general service-client capabilities not specifically justified by the stated analysis function.
Detected: suspicious.install_untrusted_source