Security audit

Pet Toy Interaction Activity Analysis | 宠物玩具互动活跃度分析

Security checks across malware telemetry and agentic risk

Overview

This skill appears to send pet media and user identifiers to a backend, but its documented and implemented outputs include unrelated face and health analysis that do not fit the stated pet-toy purpose.

Install only if you are comfortable sending pet videos, image files, URLs, and an identifier to the skill's backend. Review the publisher's privacy and retention terms first, avoid using a phone number or real username as the open-id if possible, and do not submit media or URLs that contain people, private home details, signed links, or internal network resources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documented endpoint and response schema describe a generic analysis service performing face detection and human health/diagnostic inference, which materially conflicts with the declared pet-toy interaction analysis purpose. This mismatch is dangerous because users may unknowingly send pet videos or URLs to an unrelated backend that could process human faces or sensitive content, indicating possible hidden data use, repurposed infrastructure, or deceptive capability claims.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The response fields such as face_detection, diagnosis, organ_condition, and health_warnings do not correspond to pet toy interaction tracking and instead imply biometric and health-related analysis. Such a discrepancy can mislead integrators and users about what data is being inferred and stored, creating risks of unauthorized sensitive processing and undermining trust in the skill’s declared behavior.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The skill manifest describes video-based pet toy interaction analysis, but this service also exposes generic CRUD-style operations such as add, edit, and delete on backend records. That broader capability increases the attack surface and may let the skill modify or remove server-side data unrelated to the advertised analysis workflow if those methods are reachable through the agent or supporting code.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The report-listing logic returns historical reports and enriches them with health/face-analysis-related fields that are outside the declared toy-interaction analysis scope. This creates a scope-creep data exposure risk: users or downstream callers may receive unrelated sensitive animal health history and report links without clear need-to-know boundaries.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This code explicitly extracts and surfaces generalized health assessment data from healthAiResponse or faceAnalysisResponse, which is not justified by the manifest’s stated toy-interaction purpose. Even if the data concerns pets rather than humans, it is still sensitive wellness information and broadens access beyond the intended function.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This service exposes generic CRUD and arbitrary HTTP helper methods that are broader than the stated pet-toy video analysis purpose, creating a reusable network primitive that can be invoked for unintended remote actions. In addition, the `list` method appears to call `self.page(1, ApiEnum.DEFAULT__PAGE_SIZE_MAX, ...)`, which misplaces arguments and may route attacker-controlled values into the URL slot, increasing the risk of unintended outbound requests or misuse of backend APIs.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The generic request helper does far more than a pet toy video analysis utility should: it auto-provisions accounts via /sys/phoneLogin, loads and persists tokens, updates local user records, and returns recharge/install-payment instructions on certain responses. This expands the skill's privilege and data-handling scope beyond the advertised function, increasing the risk of unauthorized account creation, identity linkage, and unintended side effects when the helper is invoked.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger rules are broad and include common phrases about pet mood, reduced play, history reports, and even uploaded image files, which can cause the skill to auto-activate in conversations where the user did not intend to invoke remote video analysis or report retrieval. Because activation leads to local file handling and API calls, accidental triggering can expose user media and identifiers without sufficiently clear intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that uploaded attachments or video/image files are automatically saved locally and that network URLs are sent to a server-side API, but it does not present a clear user-facing privacy and data-transfer warning at the point of use. This is dangerous because user media may contain sensitive household imagery, metadata, or private URLs, and users may not realize their content is being persisted and transmitted off-device.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill requires an open-id and explicitly allows using a username or phone number, while also directing the agent to read api-key values from config files and use them as open-id, without an explicit privacy warning or data-handling boundary. This mixes authentication-like secrets and personal identifiers in a way that can lead to overcollection, misuse of sensitive data, account confusion, or unintended disclosure in logs and downstream APIs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation invites upload of video files or submission of public video URLs without any warning about privacy, consent, retention, third-party access, or the risks of fetching remote content. In a video-analysis skill, this is significant because videos may contain pets, people, homes, location clues, and other sensitive information, and URL submission can also introduce server-side fetching risk that should be documented and controlled.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill reads local video bytes or forwards a remote video URL to an analysis API, but this file provides no user-facing notice, confirmation step, or visible data-handling disclosure. That can lead to unintentional transmission of sensitive pet/home footage or internal URLs, especially because remote URLs may reference private network resources or authenticated locations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script requires an --open-id value and stores it globally as the current user identifier, but there is no visible notice about collection, purpose, retention, or downstream sharing. Because this skill is for pet wellness monitoring and may process potentially sensitive usage history tied to a person, collecting identifiers without disclosure creates a real privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The analysis flow accepts either a local file path or a remote URL and calls skill.get_output_analysis(input_path), while the surrounding code and metadata indicate server-side API processing. There is no clear disclosure that user-provided local videos or URLs may be transmitted to an external service, which can expose household imagery, metadata, or signed/private URLs without informed consent.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This code performs outbound requests and transmits user/account identifiers such as openId, mobile, source, and potentially pnaUserName without any visible consent, notice, or minimization in this component. In the context of a pet wellness/video-analysis skill, sending account identifiers to backend services without clear disclosure is risky because the user may expect media analysis, not silent identity propagation or account registration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2