Reptile Excrement Analysis (Urate / Feces) | 爬宠排泄物形态识别（尿酸/粪便）

• Outcome: Review
• Latest audit: Aug 2, 2026 · 10:31 PM UTC
• Version: 1.0.7

Overview

The skill is mostly a cloud reptile-waste analysis tool, but it silently creates or reuses an account identity, stores tokens locally, and uploads data without enough user-visible control.

Install only if you are comfortable with this skill sending reptile media, URLs, report queries, and derived identity values to LifeEmergence cloud services, and with it creating local account state and storing service tokens in the workspace data directory. Review or clear data/smyx-api-key.txt and the local smyx common database if you do not want that identity reused.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its instructions clearly require shell execution, local file save/read, network access, and likely use of environment-backed identity/config. This creates a capability-transparency gap: users and host systems may approve or invoke the skill without understanding that it can move data to cloud services and write locally.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill accepts arbitrary http/https URLs as video input, even though the declared purpose is fixed-camera enclosure analysis. This broadens the trust boundary and can enable misuse of the backend to fetch or process attacker-controlled remote content, creating privacy, policy, and potential backend exposure risks if untrusted URLs are submitted.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill exposes report listing and export-link generation functionality beyond the manifest's analysis-only description. If authorization is weak in the underlying API, this can leak prior analysis metadata or report artifacts to users who should only perform single-item analysis.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The implementation materially diverges from the manifest: it performs generic video analysis and accepts remote URLs rather than being narrowly scoped to reptile excrement image/static-frame analysis. This kind of scope mismatch is dangerous because users, reviewers, and policy controls may grant the skill permissions or trust assumptions based on the manifest while the code processes broader data and functionality than disclosed.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The history-listing capability is not described in the manifest and may expose prior analysis records tied to an open_id, creating an unexpected data access surface. Even if intended for convenience, undisclosed retrieval features can leak metadata or historical outputs beyond the user's understanding of the skill's purpose.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This module exposes broad generic network and CRUD helpers (page/list/add/edit/delete/http_get/http_post/http_put/http_delete) that are not scoped to the stated reptile-excrement image-analysis purpose. In a skill context, such overbroad capabilities materially increase the attack surface and can enable unintended access, modification, or exfiltration against arbitrary backend endpoints if other components pass attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The get_user_by_username capability introduces user-account lookup functionality unrelated to excrement image analysis, creating a privacy and enumeration surface without clear business justification. If reachable from the skill, it could be abused to probe for valid usernames or retrieve user-related data beyond the declared scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements broad local persistence and mutation capabilities for user/account records, including create, update, delete, and lookup operations, which are unrelated to the declared reptile excrement image-analysis purpose. This kind of overbroad data-handling increases privacy and abuse risk because the skill can retain and modify personal account data outside user expectations and outside the minimum functionality required.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores identity-related fields and sensitive authentication material such as token and open_token, yet the skill's stated purpose is visual analysis of reptile excrement. Storing credentials or account tokens in a local SQLite database creates unnecessary credential-exposure risk if the workspace is accessed, copied, or reused across agents, and the mismatch with declared functionality makes this especially suspicious.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file contains account provisioning, token handling, and authenticated network request logic that is unrelated to the declared reptile excrement image-analysis purpose. In a skill context, this expands privileges and enables silent identity use and outbound API activity far beyond what users would reasonably expect, increasing the risk of unauthorized data transmission and platform-account abuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code resolves or creates default user identities, reads local identity material, and can automatically provision/login a platform user via fallback behavior. That is dangerous because it silently establishes persistent identities and enables network-authenticated behavior without a clear user action tied to the reptile-analysis task.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Workspace discovery, environment inspection, and automatic creation of data/skills directories are broader than necessary for simple image analysis and can expose or modify the wider agent environment. In an agent ecosystem, such context discovery can facilitate unintended access to neighboring workspace state or persistence locations.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The method name and docstring imply it reads an internal identity, but it actually reads from a file named smyx-api-key.txt. This mismatch is risky because it can cause secret material or identity tokens to be silently repurposed, leading to confused-deputy behavior and accidental credential misuse.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default trigger is broad enough to auto-invoke on any uploaded reptile-excrement image/video, even when the user may not intend cloud analysis or script execution. Over-broad triggers increase the chance of accidental data processing, unintended external requests, and surprise execution of file/network actions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs automatic saving of attachments locally and mandatory cloud API queries for history, but the user-facing description does not clearly warn that uploaded images and report-related data may be transmitted off-device. This undermines informed consent and can expose sensitive husbandry, facility, or account-linked records to external services unexpectedly.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The code reads the entire local file and submits it for remote analysis without any visible confirmation, warning, or minimization step in this component. In a media-analysis skill, this can cause unintended exfiltration of local content, especially if users provide the wrong file or do not understand that file bytes are uploaded to an external service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The debug log prints the full prompt content directly, which can expose sensitive user data, secrets, or proprietary information to logs. In an AI skill context, prompts often contain user-supplied content or internal analysis data, so logging them verbatim increases confidentiality risk and may leak data into centralized logging systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code reads environment-derived workspace context and reuses it to determine operational scope without any user-facing disclosure. In this skill context, silently inheriting environment state is unnecessary for excrement analysis and can widen access to host or agent data in non-obvious ways.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill silently reads a local file named smyx-api-key.txt and uses its contents as an identity source. Hidden consumption of local secrets or identifiers is dangerous because users invoking a reptile-analysis skill would not expect local credential-adjacent files to be accessed and repurposed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The helper posts identity fields such as openId and mobile to a remote phoneLogin endpoint with register enabled, which can create or log into accounts silently. Transmitting identity data to an external service without explicit disclosure or consent is a serious privacy and account-security issue, especially because it is unrelated to the advertised image-analysis function.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The generic HTTP utility automatically attaches tokens, API keys, authorization data, tenant identifiers, and usernames to outbound requests. This is dangerous because it can cause broad, silent exfiltration of sensitive identity and platform context to remote services under the guise of a benign reptile-analysis skill.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The code creates and stores local user records as a hidden side effect of identity resolution. Even if locally scoped, undisclosed persistence of user identities is a trust and privacy problem because it establishes durable state unrelated to the stated analysis task.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-reptile-excrement-analysis-analysis"
description: "Through a fixed camera in the reptile enclosure, the system captures a high-definition image (or a static video frame) once excrement is found, and uses AI visual analysis to identify urate (white/milky-white crystals or paste, common in lizards, geckos, etc.) — including its size (pixel area) — and to identify the morphology of feces (normally formed log, soft pasty, watery, or bloody). | 通过爬宠箱固定摄像头，在发现排泄物后拍摄高清图像（或分析视频中的静态帧），利用 AI 视觉分析技术识别尿酸（白色/乳白色结晶或膏状物，常见于蜥蜴、守宫等爬宠）的大小（面积像素）以及粪便的形态（正常成形条状、稀软糊状、水样或带血）。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 88% confidence
• Finding: description:; ‍; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2