Back to skill

Security audit

Reptile Circadian Activity Analysis | 爬宠活动量昼夜节律分析

Security checks across malware telemetry and agentic risk

Overview

This skill is a cloud-backed reptile video analysis tool, but it also uploads media, performs silent account setup, and persists identity tokens with limited user control.

Review before installing. Use this only if you are comfortable sending reptile enclosure videos or URLs to the Life Emergence cloud service and having analysis history tied to an internally managed identity. Check whether the platform offers controls for consent, deletion, retention, and token storage before using private footage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (34)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
86% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
86% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill exposes shell, network, file read/write, and environment capabilities without declaring permissions, which undermines least-privilege review and makes risky behavior harder for users and platforms to evaluate. In this context, the documentation also instructs execution of Python scripts and remote API access, so the undeclared capability gap is material rather than cosmetic.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill claims local reptile circadian video analysis, but the documented behavior adds remote API submission, identity management, local token persistence, and history retrieval that are not central to the stated function. This mismatch can mislead users into disclosing video data and allowing account-linked remote processing they did not meaningfully consent to, creating privacy and trust risks.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The manifest positions the skill as local motion-based analysis, while the body expands it into cloud-query and remote API workflows. This creates a security-relevant specification drift that can conceal data transfer and external dependencies from users and reviewers.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Automatic internal identity handling and default-user creation introduce account linkage and persistent identity state unrelated to simple video analysis. If hidden from users, this can enable silent cross-session tracking, unexpected data association, and storage of identifiers or tokens without informed consent.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The script initializes and uses an internal user identity/history mechanism even though the stated function is local or URL-based video analysis. That expands the data scope beyond what users would reasonably expect, and can enable unnecessary linkage of analysis activity to a persistent identifier or access to historical records, increasing privacy and data-exposure risk.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary http/https URLs as video input, which expands its behavior beyond the declared fixed-camera/local-capture workflow. This can enable server-side fetching of attacker-controlled resources, creating SSRF-like exposure, unexpected network access, and analysis of content outside the intended enclosure-monitoring scope.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill exposes generic report listing and export-link generation that are not part of the stated reptile circadian-analysis purpose. Hidden data-access features increase the attack surface and may allow enumeration of prior analysis records or retrieval of report artifacts if upstream authorization is weak or absent.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script exposes a `--list` mode that retrieves historical analysis records via `skill.get_output_analysis_list(open_id=open_id)`, but that capability is outside the stated circadian video analysis scope. Extra data-access features increase attack surface and can leak prior analysis metadata or outputs, especially when combined with implicit identity resolution.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code resolves and uses `open_id` even though the advertised functionality only requires analyzing enclosure video. Unnecessary identity handling creates privacy risk, enables cross-user data correlation, and becomes more dangerous here because it is also used to fetch historical analysis data.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
This file exposes broad generic HTTP wrapper methods (POST/PUT/GET/DELETE, add/edit/delete, paging) that are not constrained to the stated reptile circadian-analysis purpose. In a skill that should primarily process enclosure video and produce activity summaries, this overbroad remote-action surface enables the skill or downstream callers to interact with arbitrary backend endpoints, increasing the risk of data exfiltration or unauthorized remote actions if abused.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
The get_user_by_username capability is unrelated to reptile enclosure motion analysis and introduces an unnecessary identity/user-lookup function into the skill. Even if harmless in isolation, unjustified access to user directory data expands the available attack surface and can support account enumeration or privacy violations.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill is described as reptile enclosure video analytics, but this file defines persistent user-account management and default-user selection logic. That is a strong scope mismatch: collecting and mutating user records is unrelated to circadian activity analysis and increases the attack surface for privacy abuse or hidden identity tracking.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The model stores username, real name, email, birthday, age, and tokens despite the skill's stated purpose being enclosure-video motion analysis. Storing unnecessary personal data and authentication tokens creates confidentiality and account-takeover risk if the local SQLite database is exposed or reused across skills.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This DAO exposes broad create, update, and delete capabilities that go well beyond the manifest's expected behavior of reading video-derived metrics and producing reports. In a mismatched skill context, such generalized mutation primitives can be repurposed to tamper with unrelated local data or persist hidden state.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill manifest describes a narrowly scoped local video-motion analysis function, but the code adds a generic `ai_chat(prompt, session_id, timeout)` capability that can process arbitrary prompts and potentially interact with an external agent. This scope mismatch creates an unnecessary expansion of privilege and behavior, increasing the risk of prompt-based misuse, data exfiltration, or unauthorized actions if the stubbed logic is later enabled.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code is structured to invoke an external agent via command construction for a task that should be achievable with local motion detection and circadian charting. Even though the subprocess call is currently commented out, retaining this capability pattern introduces a dangerous integration point that could later be re-enabled without proper review, enabling unintended outbound execution or transfer of enclosure-derived data.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The docstring claims subprocess-based agent invocation, but the implementation does not perform that action and instead uses a placeholder dictionary. This inconsistency is dangerous because it obscures the real behavior of the code, can mislead reviewers about whether external execution is active, and may hide partially implemented features that are easy to enable later without adequate safeguards.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This shared utility performs remote API calls, token handling, automatic account bootstrap, and identifier propagation that are unrelated to a local reptile circadian video-analysis skill. That creates hidden data flows and expands the trust boundary: using the skill can silently contact external services and couple local analysis to remote identity and billing systems.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code can derive, create, persist, and reuse user identities locally, including generating synthetic default IDs and storing them in a local database. For a reptile enclosure activity-analysis skill, this is unjustified capability creep and can enable silent user tracking, linkage across sessions, and unintended account creation without informed consent.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The workspace and agent-environment detection code scans filesystem structure, infers agent context, and creates directories beyond what is necessary for simple local motion analysis. While not directly exploitable on its own, it broadens access to host environment metadata and increases the skill's ability to discover and affect surrounding workspace state.

Vague Triggers

Medium
Confidence
84% confidence
Finding
A default trigger that activates on general video-analysis requests is too broad for a skill that can save files, run scripts, and contact remote services. Overbroad invocation increases the chance of accidental execution on unrelated user content, leading to unintended data handling or API calls.

Vague Triggers

Medium
Confidence
85% confidence
Finding
Automatic history-report lookup based on broad keywords can trigger remote account-linked queries without sufficiently explicit user intent. Because the skill uses internal identity association, this raises privacy concerns and the risk of exposing or fetching records unexpectedly.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments are automatically saved locally, but does not prominently warn users in the high-level description or obtain clear consent. Local persistence of user-supplied media can expose sensitive content through retention, unintended reuse, or insecure filesystem handling.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2