Security audit
Security checks for vulnerabilities and agentic risk
This skill largely matches its pet-training analysis purpose, but it quietly links uploads to a persistent cloud identity and cloud history, so users should review it before installing.
Install only if you are comfortable sending pet-training videos or media URLs to the LifeEmergence cloud service and having results associated with a persistent local/cloud identity. Review retention and account controls before using sensitive footage, and treat history queries as cloud account data access rather than a local-only feature.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
The skill appears to manage workspace paths, read/write local data files, resolve or create user identities, and call remote login/registration endpoints despite being described as video posture analysis. In a media-upload context, this hidden identity/account handling is especially sensitive because it couples user content with account creation, token acquisition, and local data persistence without clear disclosure.
A YARA hit for metadata/tool poisoning indicators in the manifest is a meaningful red flag because malicious or deceptive skills often manipulate descriptive metadata to influence tool selection, trust decisions, or reviewer interpretation. Given the broader pattern of description-behavior mismatch and undeclared capabilities, this indicator increases suspicion that the manifest may be crafted to conceal or reframe risky behavior.
---
name: "smyx-pet-training-command-execution-analysis"
description: "Triggers when a user provides a training-area video of a pet for analysis; supports local uploads or network URLs to call server-side APIs for command-execution recognition, detecting whether the pet's body posture matches the issued commands (Sit / Down / Stay), comparing posture timing against command timestamps, and judging execution success. When the command is not executed, the result can trigger an external voice repeat-prompt signal (not a medical / behavior-therapy advice). Application scenarios: smart dog-training devices, remote pet training, behavior correction. | 当�
The code grants arbitrary remote resource modification capability through unconstrained http_post, http_put, and http_delete wrappers plus generic add/edit/delete methods, without any visible restriction tying them to pet-video analysis endpoints. If attacker-controlled or overly permissive calling code can influence the target URL or payload, the skill could be abused as a proxy to alter backend state or interact with unintended services, which is especially risky given the manifest only justifies analytics behavior.
This utility code creates, resolves, and persists platform user identities and tokens, including reading workspace credentials and generating default identities, even though the declared skill is for pet-training video analysis. That hidden identity-management behavior expands the skill's privilege surface, enables silent account reuse or impersonation, and is unjustified in context, making the mismatch especially concerning.
The HTTP helper can silently call an external health endpoint to register or log in a user using generated or recovered identifiers when tokens are missing. For a pet-training analysis skill, auto-registering accounts against an unrelated external service is a severe scope violation that can transmit identity data off-box and create unauthorized external side effects without meaningful user awareness.
The skill declares powerful capabilities in practice (shell, network, file read/write, environment access) but does not scope or disclose them via permissions or allowed-tools metadata. This weakens reviewability and containment, making it easier for a skill that appears benign to perform higher-risk operations than users or the platform expect.
The skill does not clearly warn users that uploaded files and supplied URLs are sent to server-side/cloud APIs and that attachments may be saved locally. This lack of transparency undermines informed consent and can expose sensitive media, metadata, or local file content to remote services unexpectedly.
Overly broad trigger conditions can cause the skill to activate on routine pet-training conversations, increasing the chance of unintended file handling, network requests, or history lookups. In a skill with undeclared backend and identity-linked behavior, accidental activation materially raises privacy and misuse risk.
The documentation expands the skill from on-demand pet command-execution analysis into cloud-based historical report retrieval, which changes the data-access scope from current-input processing to account-linked record access. That broader scope is security-relevant because it can expose prior user data and should be explicitly declared, reviewed, and permissioned.
The script exposes a --list mode that retrieves prior analysis records by open_id, which is outside the stated purpose of analyzing a user-provided training video. This broadens the tool from a single-purpose analyzer into a data-access interface and can enable unauthorized enumeration or disclosure of historical user data if identity checks are weak or bypassable.
The script accepts a network URL as input and passes it into analysis, which likely causes remote fetching or transmission of user-supplied media. Although there is a generic progress message, there is no explicit user-facing warning that remote content may be retrieved or sent to backend services.
The code performs hidden identity resolution via OpenIdUtil.resolve_current_open_id(...) while suppressing --open-id from normal help output. That combination creates a privacy and authorization risk because identity-sensitive behavior is present without clear disclosure, and a caller may be able to influence or infer which user's data is accessed.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Multiple user-facing strings are hard-coded in Chinese, such as the report header and export-link text, indicating the skill is designed to respond in a specific language by default. The file does not provide any user opt-in, locale selection, or justification for this language constraint.
The code reads arbitrary local file contents from a supplied path and uploads the full bytes to a backend analysis service, but this file contains no user-facing notice, consent check, or restriction to a controlled workspace. In an agent setting, this can cause unintended exfiltration of sensitive local files if a user or upstream component passes an unexpected path.
Detected: suspicious.install_untrusted_source