Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a cloud reptile-waste analysis skill, but it silently creates or reuses an identity and persists service tokens locally, so users should review it before installation.
Install only if you are comfortable sending reptile enclosure media or URLs to the configured LifeEmergence/Open API service and allowing the skill to create or reuse a local identity. Review how local tokens, report history, and uploaded media are retained; a dedicated test identity/workspace would reduce exposure.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
The skill is presented as a narrow reptile-excrement vision-analysis feature, but the findings indicate generic backend API access, local persistence, user/open-id handling, config/env access, and other undeclared behaviors. This kind of description-behavior mismatch is dangerous because it can mislead operators into approving a skill with broader data access and execution privileges than its stated purpose suggests.
A YARA match for tool/metadata poisoning indicators in the skill manifest is a serious red flag because poisoned metadata can manipulate how an agent interprets the skill's purpose, trust level, or invocation behavior. Even if accidental, suspicious manifest content combined with the other description-behavior mismatches increases the chance of deceptive packaging.
---
name: "smyx-reptile-excrement-analysis-analysis"
description: "Through a fixed camera in the reptile enclosure, the system captures a high-definition image (or a static video frame) once excrement is found, and uses AI visual analysis to identify urate (white/milky-white crystals or paste, common in lizards, geckos, etc.) — including its size (pixel area) — and to identify the morphology of feces (normally formed log, soft pasty, watery, or bloody). | 通过爬宠箱固定摄像头，在发现排泄物后拍摄高清图像（或分析视频中的静态帧），利用 AI 视觉分析技术识别尿酸（白色/乳白色结晶或膏状物�
The User model stores identity data and especially token/open_token fields despite the manifest describing only enclosure waste analysis. Retaining authentication material in a local SQLite database is high risk because compromise of the workspace or accidental reuse by other components can expose credentials or enable account takeover.
The code silently derives or creates a default open-id from workspace files or a local database and then persists/reuses that identity. For a camera-based feces-analysis skill, hidden identity bootstrapping is unnecessary and materially increases the chance of unauthorized account creation, cross-session tracking, and misuse of another local identity.
This utility file performs broad network access, token handling, local user lookup, implicit registration/login, and database-backed credential reuse that are unrelated to the declared reptile excrement image-analysis purpose. That capability mismatch is dangerous because it creates an undisclosed account/bootstrap channel and arbitrary API communication path that could exfiltrate data or act on behalf of the user without meaningful consent.
The skill declares no explicit tool/permission scope even though its documented and inferred behavior includes shell execution, filesystem access, environment access, and network use. In an agent environment, missing least-privilege boundaries makes it easier for the skill to access or exfiltrate more data than users expect.
The default trigger is broad enough to activate on essentially any reptile-excrement image or video analysis request. Overbroad auto-invocation can cause unintended processing of attachments and unnecessary transfer of sensitive media or metadata to the skill's backend.
The history-report trigger uses broad natural-language phrases and automatically performs cloud report lookup. This increases the risk of unintended retrieval of prior records, which may expose sensitive historical data when a user is merely asking a general question.
The skill says uploaded attachments are automatically saved locally, but does not provide a clear upfront warning to the user. Silent local persistence of user-provided media creates privacy and retention risk, especially for files that may contain identifying metadata or unrelated sensitive content.
The skill omits a clear upfront privacy warning that analysis and history retrieval involve cloud API use and remote access to user report data. Users may believe processing is local when their files and report history are actually transmitted to external services, increasing confidentiality and compliance risk.
The script initializes and uses an internal user identity through OpenIdUtil.resolve_current_open_id and later uses ConstantEnum.CURRENT__OPEN_ID for record listing, while hiding the mechanism from normal CLI help. Hidden identity selection or impersonation paths reduce user awareness and auditability, and if the downstream utility accepts arbitrary IDs, it could enable unauthorized access to another user's analysis history.
The manifest describes analyzing images to identify urate presence/size in pixel area and feces morphology categories. The runtime status message says the tool analyzes urate area/color, feces color/morphology/blood, compares against species normal ranges, and assesses kidney and intestinal health, which is materially broader than the declared purpose.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill accepts arbitrary HTTP/HTTPS video URLs, which expands behavior beyond the stated fixed-camera/local enclosure analysis use case. This can enable analysis of attacker-controlled remote content and broadens the trust boundary, creating privacy, policy, and potential SSRF-like exposure depending on how downstream services fetch the URL.