Back to skill

Security audit

Reptile Feeding Refusal / Vomiting Detection | 爬宠进食拒绝/呕吐识别

Security checks across malware telemetry and agentic risk

Overview

The skill appears to provide the advertised reptile video analysis, but it also creates and reuses account identity, stores tokens locally, and sends media and identifiers to cloud services with weak user-facing consent controls.

Review this skill before installing if you do not want reptile enclosure footage, supplied video URLs, account identifiers, or report history sent to the vendor cloud. Prefer installing only with an account and workspace you are comfortable linking to this service, and check whether the publisher offers explicit consent, retention, and token-storage controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, environment-derived identity, and network/API access, but it declares no explicit permissions or trust boundaries. This creates a capability mismatch where a reviewer or runtime may underestimate the skill’s power, increasing the chance of unauthorized file access, data exfiltration, or command execution through normal use.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The script exposes a `--list` path that retrieves prior analysis history via `skill.get_output_analysis_list(open_id=...)`, which is outside the stated purpose of analyzing a supplied video. Combined with hidden identity resolution elsewhere in the file, this creates an unnecessary data-access surface that could disclose prior events or behavioral records for a user without clear consent or scope limitation.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill exposes a history-listing function that is not part of the stated purpose of analyzing a provided reptile-feeding video for refusal or regurgitation events. This expands the data-access surface from single-input analysis to retrieval of prior account activity, which can disclose historical analysis results or metadata if invoked inappropriately or without clear authorization boundaries.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code resolves and uses an account-scoped open_id to fetch history, even though identity-based history access is not justified by the described skill purpose. This creates a privacy and authorization risk: if identity resolution is weak, spoofable, or implicitly derived from ambient context, a caller may access another user's historical analysis data or trigger account-scoped operations without informed consent.

Description-Behavior Mismatch

High
Confidence
91% confidence
Finding
The file implements persistent user-account storage, including identity fields, inside a reptile feeding-analysis skill whose stated purpose is narrow video behavior detection. This scope mismatch is a strong indicator of overcollection and hidden data handling, increasing privacy and supply-chain risk because the skill can retain unrelated personal data without clear necessity.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The User model stores token, open_token, email, realname, birthday, and other personal profile data despite the skill being framed as reptile behavior analysis. Storing authentication-like secrets and PII in a local SQLite database materially raises credential theft and privacy risk, especially since the file also provides generic CRUD operations around that data.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility code performs remote account provisioning, token handling, and authenticated API requests that are far outside the stated purpose of reptile feeding/video analysis. In this skill context, hidden identity creation and networked service interaction materially increase risk because users would reasonably expect local vision processing, not external account lifecycle and backend coupling.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
This code reads workspace identity material, resolves a current open-id, and persists/reuses local user identity state unrelated to detecting feeding refusal or regurgitation. In a camera-analysis skill, this mismatch is suspicious because it expands data collection and persistence beyond user expectations and creates privacy and account-abuse risk.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The payment and recharge guidance shown on HTTP 402 introduces monetization workflow behavior unrelated to reptile feeding-event detection. In this skill context, embedding billing prompts indicates undisclosed dependency on paid remote services and can mislead users about what the skill does and what data/services it uses.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The default trigger activates on essentially any reptile feeding video submission, which can cause the skill to run without sufficiently specific user intent. In a skill that saves files and sends content to external processing, over-broad auto-invocation raises the risk of unintended data handling and surprise execution.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The history-query trigger is based on broad keywords and automatically calls a cloud API, without clear scoping or confirmation. This can expose report metadata unexpectedly, especially if users mention related terms conversationally rather than intending a records lookup.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill accepts local files and public URLs and states that an API service will process them, but it does not clearly warn users up front that their media may be transmitted to a cloud service. This weakens informed consent and can lead to unintentional disclosure of sensitive footage, location-linked husbandry details, or account-associated records.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The call to `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` initializes internal identity state without clear user disclosure, and the resulting identity is later used for listing prior analysis events. Hidden identity resolution can bind operations to an internal account or current user context unexpectedly, enabling privacy violations, unauthorized record access, or confusing cross-user data exposure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code accepts either a local file path or a remote video URL, reads the local file into memory, and forwards that content to an external analysis API via `self.analysis(...)` without any user-facing consent prompt, trust boundary notice, or restriction on remote destinations in this file. In a video-analysis skill, exfiltrating enclosure footage or arbitrary local files supplied as input can expose sensitive data, and accepting attacker-controlled URLs can also cause the backend service to fetch untrusted resources, increasing privacy and SSRF-style risk depending on the downstream API behavior.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The utility automatically creates workspace data and skills directories without clear disclosure to the user. While directory creation is common, doing so silently in a skill whose declared purpose is video analysis increases surprise and can facilitate persistence of state or later installation behavior users did not expect.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads identity material from data/smyx-api-key.txt and uses/stores authentication-related state without clear user disclosure. This creates a risk of silently binding the skill to local credentials or identities, which is particularly inappropriate for a skill expected to analyze enclosure camera footage.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request wrapper sends outbound HTTP requests with user identity fields and authentication headers, and may also attach tenant and platform metadata. In the context of a reptile feeding-analysis skill, undisclosed transmission of identifiers and tokens is a significant privacy and security concern because it exceeds the apparent need for local video-event detection.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | **4 级提醒策略递进**(info → notice → important → urgent),呕吐事件直接进入 Level 4 |
| 🔎 使用提醒 | 单日提醒上限:Level 1 不限 / Level 2 × 4 / Level 3 × 3 / **Level 4 × 5(呕吐每次必报,不可压制)** |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **🚨 禁止**做"隐孢子虫病 / 库道虫病 / OPMV / 蛇类传染性脑膜炎 / 肠道堵塞 / 代谢性骨病"等具体疾病诊断 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案、灌肠剂、催吐剂、止吐药 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出"强制开口喂食""灌食""饥饿疗法 X 天"等具体操作剂量(任何操作必须由兽医现场判断) |
| 🔎 使用提醒 | **禁止**长期存储完整爬宠箱视频(≤ 14 天,仅入库喂食事件 + 异常事件片段;养殖场按管理规定) |
Confidence
84% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-reptile-feeding-refusal-vomiting-analysis"
description: "Through fixed enclosure cameras, the system analyzes feeding-time and post-feeding videos of reptiles (snakes, lizards, turtles) to detect prey-attack behavior, successful swallowing, and regurgitation (vomiting). | 通过爬宠箱固定摄像头,分析喂食时及喂食后一段时间的视频,检测爬行动物(如蛇、蜥蜴、龟)的进食行为:是否主动攻击猎物(如鼠、昆虫)、是否成功吞食、以及是否在进食后短时间内将食物吐出(反吐)。当宠物对猎物无视、逃避(拒食)或将已吞入的食物吐出时,记录异常事件并输出提示。"
version: "1.0.7"
license: "MIT-0"
---
Confidence
76% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2