ClawHub
Back to skill

Security audit

Pet Training Command Execution Recognition | 宠物训练指令执行识别（坐/卧/等）

Security checks across malware telemetry and agentic risk

Overview

This skill is review-worthy because it uploads pet videos or URLs to remote analysis services while silently creating or reusing an account, persisting tokens locally, and shipping with private development API endpoints.

Install only if you are comfortable with pet videos or supplied video URLs being sent to the publisher's analysis service and with the skill creating or reusing a local account identity. Before approval, the publisher should replace the private dev endpoints with intended production HTTPS endpoints, add explicit upload/history-query consent, document account and token storage, and provide a way to reset or delete the persisted identity data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
The list() method accepts an arbitrary filters dict and uses getattr(self.__model__, key) without validating that key is an expected column name. If upstream user input reaches this method, an attacker can trigger exceptions or interact with unintended ORM attributes, creating a query-manipulation/denial-of-service surface even though classic SQL injection is mitigated by SQLAlchemy's parameterization.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
The count() method repeats the same unvalidated dynamic attribute lookup on filter keys. In contexts where filter names can be influenced externally, this can be abused to cause crashes or access unintended mapped attributes, broadening the attack surface of the DAO.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to run local Python scripts, read and write files, access the network, and invoke shell commands, yet it declares no corresponding permissions or safety boundaries. This creates a mismatch between apparent trust level and actual capability, increasing the chance of unsafe execution, hidden data access, or unreviewed outbound transfers.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill accepts any http/https URL and forwards it as videoUrl to a server-side analysis backend without allowlisting domains, restricting address ranges, or validating scheme/target safety. In practice this can enable SSRF-style behavior against internal services or make the backend fetch attacker-controlled resources, which is more concerning here because the skill is explicitly designed to ingest user-supplied network media URLs.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The code comments indicate open_id should be required, but the enforcement is commented out and the analysis request proceeds without any caller identity check. If the downstream API does not independently enforce authorization, this allows unauthenticated or improperly attributed analysis submissions and weakens auditing/account isolation.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
Report listing similarly ignores the commented requirement for open_id and calls page() without enforcing requester identity. If backend authorization is weak or absent, users may enumerate or retrieve other users' analysis metadata and report links, creating a direct data exposure risk.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This file exposes broad generic HTTP/CRUD helper methods (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, and paging helpers) that are not constrained to the declared pet-training video analysis purpose. If higher-level skill logic allows user-influenced URLs, parameters, or payloads to flow into these wrappers, the skill can be repurposed to access unintended internal or external services, expanding the attack surface and enabling SSRF-style misuse or unauthorized API actions.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
A generic user-account DAO with identity fields is outside the stated purpose of pet command-execution video analysis. This kind of scope expansion increases the amount of sensitive state the skill can access or persist, raising privacy and lateral-abuse risk if the skill or surrounding agent is compromised.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The User model persistently stores token, open_token, email, birthday, and other profile data even though the declared skill purpose is posture/command analysis on pet videos. Storing authentication tokens and personal data unnecessarily enlarges the blast radius of any local compromise and creates unjustified privacy exposure.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The utility performs silent account provisioning, token acquisition, and token persistence that are unrelated to the declared pet-video posture analysis function. This expands the skill's authority beyond user expectations and can create unauthorized remote accounts, cross-service identity linkage, and hidden authenticated access if the skill is installed in a broader agent environment.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The file contains workspace discovery, data-directory creation, API-key file reads, and local identity persistence logic that exceeds the stated pet-command analysis purpose. In an agent platform, broad workspace inspection and persistence increase the blast radius by enabling collection or reuse of local identifiers and files unrelated to the user's video-analysis request.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default trigger is broad enough to activate whenever a user provides a video URL or file for analysis, even when the user may not intend to invoke this specific skill. Unintended activation is risky here because the skill can save files locally, call server-side APIs, and query cloud history automatically.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that local files and network URLs are sent to server-side APIs, but it does not present a clear user-facing warning or consent step before transmitting potentially sensitive media. Training-area videos may contain people, homes, metadata, or location clues, so silent upload to cloud services creates privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Debug mode enables low-level HTTP and urllib3 logging, which can leak request URLs, bodies, metadata, and potentially authorization material into console or log sinks. In this skill, requests later include tokens and user identifiers, so verbose transport logging materially increases accidental secret and privacy exposure.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code automatically creates and persists a default local user identity when no explicit open-id is supplied, without any visible consent or disclosure in this file. Silent identity creation can surprise users, create durable tracking identifiers, and cause downstream authenticated actions to be attributed to a synthetic account.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Authenticated requests automatically attach tokens, API keys, authorization headers, and user-identifying fields such as pnaUserName/tenant metadata, without clear user disclosure in this code path. Because the manifest only describes pet-training video analysis, this hidden identity-bearing transmission is more sensitive: users may reasonably expect media analysis, not background account-linked telemetry and credentialed API use.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
90% confidence
Finding
This code sends openId/mobile/source data to an external login endpoint to silently register or authenticate a user. External transmission is expected for some cloud-backed skills, but here it is higher risk because it performs identity-related network calls outside the narrowly described pet-video analysis function and without evident consent handling in the file.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB，建议覆盖完整指令-响应过程 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供训练效果参考，不提供疾病诊断或行为治疗方案 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，API 服务会自动下载 |
| 🔎 使用提醒 | 声控重复提示信号由智能训狗设备基于本技能的输出结果触发，本技能仅负责输出干预建议 |
Confidence
73% confidence
Finding
The hidden-instructions signal is credible in this context because the skill contains embedded operational directives that influence agent behavior around script use, network handling, and output shaping in ways not obvious to the end user. Hidden or non-obvious control text is dangerous because it can steer an agent to perform sensitive actions, suppress safeguards, or privilege manifest instructions over user awareness.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-training-command-execution-analysis"
description: "Triggers when a user provides a training-area video of a pet for analysis; supports local uploads or network URLs to call server-side APIs for command-execution recognition, detecting whether the pet's body posture matches the issued commands (Sit / Down / Stay), comparing posture timing against command timestamps, and judging execution success. When the command is not executed, the result can trigger an external voice repeat-prompt signal (not a medical / behavior-therapy advice). Application scenarios: smart dog-training devices, remote pet training, behavior correction. | 当用户提供训练区域视频时，触发本技能进行姿态-指令匹配分析；支持通过上传本地视频或网络视频URL，调用服务端API检测宠物身体姿态是否符合“坐/卧/等”指令标准，对比指令发出时间，判断是否执行成功；未执行时可由外部设备触发声控重复提示信号（不提供疾病诊断或行为治疗方案）。应用场景：智能训狗设备、宠物远程训练、行为矫正。"
version: "1.0.11"
license: "MIT-0"
---
Confidence
78% confidence
Finding
The manifest shows metadata poisoning indicators and mixes descriptive text with operational influence in a way that can manipulate tool or agent behavior. In a skill that already directs shell execution, network access, automatic cloud queries, and hidden identity handling, poisoned metadata becomes more dangerous because agents may over-trust manifest fields and execute sensitive actions without sufficient scrutiny.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2