Pet Treadmill Intensity & Heart Rate Analysis | 宠物跑步机运动强度与心率关联

• Outcome: Review
• Latest audit: Jun 9, 2026 · 7:49 PM UTC
• Version: 1.0.0

Overview

This skill appears intended for pet treadmill video analysis, but it also uploads media, links results to personal identifiers, retrieves report links, creates or reuses backend accounts, and stores tokens locally with incomplete user-facing controls.

Review carefully before installing. Only use this skill if you trust the publisher and backend with pet/home videos, public video URLs, usernames or phone numbers, account tokens, and report history. Avoid using personal phone numbers as identifiers when possible, do not rely on report links being private unless the backend proves access control, and check how stored tokens and uploaded media can be deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill directs use of file access, shell execution, network calls, environment/path usage, and local file saving, yet declares no permissions. This creates a transparency and governance gap: users and hosting platforms cannot accurately assess what the skill can access or transmit, increasing the chance of unexpected data handling and unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is benign pet exercise analysis, but the behavior described by the findings includes account linkage/login using open-id or phone-like identifiers, local token/user storage, cloud history retrieval, and report link construction unrelated to the stated core function. This mismatch is dangerous because it can mislead users into sharing identifiers and media under false expectations while enabling broader data collection and remote account interactions than advertised.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The CLI advertises an '--export-env-only' mode that should avoid running analysis, but the flag is ignored and execution continues normally. In a tool that may process local pet videos, remote URLs, and user identifiers, this can cause unexpected data processing or network activity despite the user's explicit attempt to prevent it.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented API endpoint and response schema are fundamentally inconsistent with the stated pet treadmill exercise-intensity purpose. It describes a generic `/common-analysis` service returning face detection and human constitution/organ-diagnosis data, which strongly suggests the skill may invoke an unrelated backend or expose users to undisclosed biometric/health processing. In this context, the mismatch is dangerous because pet video and optional heart-rate data could be sent to an endpoint not designed for the advertised function, creating integrity, privacy, and trust risks.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to perform pet treadmill exercise-intensity analysis, but this service layer also exposes generic record-management functions for listing, adding, editing, and deleting camera/device-related records. That expands the privilege and attack surface beyond the stated purpose, creating a risky capability mismatch: if these methods are reachable through the skill, an attacker or confused consumer could enumerate or modify device records unrelated to analysis.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill exposes report-listing and export-link capabilities that go beyond the declared real-time pet treadmill intensity analysis scope. This expands data access to historical reports and direct report-image URLs, increasing the chance of unauthorized access, excessive data exposure, or misuse if callers can enumerate or retrieve reports not strictly needed for the advertised function.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The legacy report-listing path processes unrelated health and face-assessment fields, indicating code reuse from another domain and creating a mismatch between declared purpose and actual data handling. That mismatch raises the risk that unrelated or sensitive data is surfaced to users or downstream systems without proper need, consent, or review.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This file exposes a generic API wrapper with arbitrary HTTP methods and CRUD-style helpers that are not constrained to the pet treadmill intensity-analysis use case. In an agent skill context, this broad network capability can be repurposed to access unintended internal or external endpoints, increasing the risk of data exfiltration, unauthorized API use, or scope creep beyond the declared functionality.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This shared configuration code reads unrelated identity and messaging environment variables such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID, which are not necessary for pet treadmill intensity analysis. Even though it does not exfiltrate them in this file, collecting broader user identifiers than required expands the skill’s access to sensitive context and increases the risk of accidental leakage or downstream misuse by other components.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The file defines a generic user table storing username, email, token, and open_token data, which is unrelated to pet treadmill intensity analysis and expands the skill's data-handling scope. In an agent skill, this kind of unjustified credential/token persistence increases the blast radius of compromise and creates unnecessary privacy and secret-retention risk.

Context-Inappropriate Capability

Low

• Confidence: 70% confidence
• Finding: The database path is influenced by the OPENCLAW_WORKSPACE environment variable, allowing storage location changes outside a fixed application directory. In isolation this is not severe, but in an agent/runtime environment it can enable unintended data placement, easier persistence across workspaces, or writing to locations not expected for this skill's stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer contains login/registration and payment-handling logic that is unrelated to the stated pet treadmill video-analysis function. Hidden account provisioning and billing-flow behavior expands the skill’s privileges and data handling surface, creating a strong risk of unauthorized account creation, undisclosed data transmission, and abuse if invoked by other parts of the skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can derive a backend identity from a username/API secret and automatically call /sys/phoneLogin with register=1, silently creating or logging into a user account. For a pet exercise analysis skill, this capability is unjustified and dangerous because it can establish backend accounts without clear authorization or user awareness.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger rules are broad enough to auto-activate on general pet treadmill video analysis requests, which can cause the skill to run and handle files or identifiers without sufficiently specific user intent. In a skill that also saves files and contacts remote services, overbroad activation increases the risk of unintended data processing and disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that uploaded attachments or video files will be automatically saved locally, but it does not clearly present a user-facing warning, retention policy, or consent step. Automatically persisting user-provided media can expose sensitive data through local storage, later reuse, or unintended access by other tools or users on the system.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The history-query instructions require sending an open-id to a cloud API and returning remote report data, but the skill text does not clearly warn users that identifiers and report queries are transmitted off-device. This is dangerous because users may unknowingly expose personal identifiers and historical records to a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The API accepts direct video uploads and public video URLs, and the skill description includes optional heart-rate band data, yet the document gives no warning or handling guidance for biometric and health-adjacent data. This omission can lead operators or users to transmit sensitive pet-owner environment footage and physiological data without informed consent, retention limits, or secure handling expectations. The skill context increases concern because continuous treadmill video may capture homes, owners, and other unintended subjects.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code reads the full local file and transmits it for remote analysis, but this file contains no visible user-facing disclosure, consent prompt, or minimization controls. In a video-analysis skill, uploaded files may contain sensitive household imagery, people, location cues, or embedded metadata, so silent transmission can create privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function accepts a user-supplied local file path or remote URL and forwards it into backend analysis logic without any user-facing notice, consent step, or clear boundary about what data is transmitted or retained. In this skill’s context, treadmill video of pets may also capture owners, homes, location clues, or attached biometric data, so silent transmission creates a real privacy and data-handling risk even if it is not a code-execution flaw.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The CLI makes a user identifier mandatory and explicitly suggests sensitive identifiers such as phone numbers, encouraging collection of personal data without necessity, minimization, or privacy-preserving alternatives. In a pet exercise-analysis skill that may also process video and optional heart-rate data, linking telemetry to direct identifiers materially increases privacy impact and potential regulatory exposure.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code reads environment-derived user identifiers without any indication of consent, purpose limitation, or minimization, and then stores them in globally accessible configuration fields. In the context of a pet treadmill analysis skill, this collection is not clearly justified, so it increases privacy risk and can enable unintended identity linkage across subsystems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Requests include authentication headers and user-identifying fields such as pnaUserName, mobile/openId-derived values, and tenant/platform metadata, but this file shows no disclosure, consent, or minimization controls. In a video-analysis skill involving pet owners and optional heart-rate data, silent outbound transmission increases privacy and compliance risk.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs retrieval and display of cloud-stored historical reports tied to a user identifier, including direct report hyperlinks. This creates a straightforward natural-language data exposure path: anyone who can induce use of an identifier may obtain sensitive historical records or shareable report URLs.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The open-id flow tells the agent to read api-key values from config files and reuse them as a user identifier. This is a direct secret-retrieval and repurposing pattern: it encourages reading sensitive configuration material from disk and using a credential-like value in another context, which can leak secrets, break account boundaries, and enable unauthorized API access or report retrieval.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2