Reptile Feeding Refusal / Vomiting Detection | 爬宠进食拒绝/呕吐识别

• Outcome: Review
• Latest audit: Nov 10, 2026 · 6:23 AM UTC
• Version: 1.0.16

Overview

ClawScan marks this skill suspicious because scanners report account and credential handling, broad credentialed network requests, and analysis behavior that may upload video even in export-only mode, beyond the stated reptile-video purpose.

The verdict is suspicious, not malicious, and does not establish that the author intended harm. Consider the reported credential handling, account registration, and video upload behavior before installing; the scan was partial because a referenced local path was missing, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk primarily implements user-account persistence rather than reptile video analysis. Generic database operations could support recording feeding events, but the concrete sys_user model, token fields, username-based updates, and default-user selection serve an undeclared identity-management function. No camera access, video processing, feeding-behavior detection, or abnormal-event alerting appears in this chunk. This assessment is limited to the supplied code; it does not establish what other skill components do or imply that stored data is transmitted externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Generic JSON, file, date, and polling helpers could reasonably support the declared functionality and are not independently mismatches. However, this chunk additionally implements an undeclared account, credential, remote-registration, and billing workflow that accesses resources outside the described camera-analysis task. These operations occur when the relevant helpers are called, rather than all executing on import. The absence of video logic in a shared utility module alone would not establish a mismatch for the entire skill, but the visible identity and account-management capabilities materially exceed the supplied description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk is generic infrastructure rather than an implementation of the declared reptile-feeding analysis purpose. No subprocess actually runs, so it should not be credited with command execution. Imported base classes and API-service implementations are not supplied; they could contain additional functionality, but the visible code does not establish the declared behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence

Finding

Generic AI-analysis endpoints could support the declared functionality and are not inherently a mismatch. However, DETAIL_EXPORT_URL explicitly targets '/health/order/api/getReportDetailExport?id=', an unrelated health-order reporting resource not explained by the description. This chunk only defines configuration; it does not itself make requests or export reports. The mismatch therefore concerns the configured resource, not demonstrated network activity, and the absence of video-analysis logic alone is not treated as evidence of a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-reptile-feeding-refusal-vomiting-analysis"
description: "Through fixed enclosure cameras, the system analyzes feeding-time and post-feeding videos of reptiles (snakes, lizards, turtles) to detect prey-attack behavior, successful swallowing, and regurgitation (vomiting). | 通过爬宠箱固定摄像头，分析喂食时及喂食后一段时间的视频，检测爬行动物（如蛇、蜥蜴、龟）的进食行为：是否主动攻击猎物（如鼠、昆虫）、是否成功吞食、以及是否在进食后短时间内将食物吐出（反吐）。当宠物对猎物无视、逃避（拒食）或将已吞入的食物吐出时，记录�

The HTTP helper attaches service credentials to arbitrary caller-supplied destinations.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The helper accepts arbitrary absolute HTTP or HTTPS URLs and automatically adds service tokens and the API key regardless of destination. If an attacker can influence a requested URL, credentials can be sent to an attacker-controlled host; accepting HTTP also permits plaintext credential transmission.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The local-video analysis workflow lacks an explicit warning that user footage is transmitted to a remote API.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

Although the documentation mentions an API, it does not clearly tell users that selecting a local video uploads its contents for remote processing. Enclosure-camera footage can include people, private interiors, or commercial breeding operations, making undisclosed transfer a meaningful privacy risk.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to execute analysis, but analysis still runs.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser accepts --export-env-only and promises not to analyze, but the program never checks the flag. With an input supplied, execution continues into remote analysis, potentially uploading private footage and incurring charges despite the user's explicit non-analysis selection.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local input files are submitted to the analysis API without an upload or privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The code reads the complete local file and passes it as an upload to the analysis service without an explicit disclosure or authorization gate in this path. Users expecting local processing can consequently expose private camera footage to an external processor.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The export-only flag is parsed but never used to stop execution. When an input accompanies it, the script still invokes video analysis, potentially transmitting footage or consuming paid resources contrary to the selected mode.

Content

No source excerpt is available for this finding.

The service exposes username-based user lookup unrelated to reptile feeding analysis.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The get_user_by_username method delegates a supplied username to a user-lookup utility. Looking up user accounts is not an obvious requirement of detecting feeding, refusal, or regurgitation in enclosure videos, and the manifest does not declare account-management functionality.

Content

No source excerpt is available for this finding.

The skill includes user-profile and credential-token persistence unrelated to reptile feeding analysis.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The model stores authentication tokens alongside personal profile data in a workspace-shared SQLite database, without application-level encryption or explicit restrictive permissions shown. Exposure of that database through workspace access or backups could disclose reusable credentials; the reptile-analysis purpose does not explain why this sensitive persistence is necessary.

Content

No source excerpt is available for this finding.

ai_chat claims to invoke an analysis agent, but its implementation never runs the agent or returns analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L26 explicitly promises to call openclaw agent through subprocess, but the entire subprocess invocation is commented out at L61–L66. Instead, the method creates an empty dictionary and accesses its nonexistent stderr attribute, causing an exception that is swallowed; it therefore returns None without performing the documented analysis.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The generically named open helper always uses write mode, which immediately truncates an existing file even before the caller writes anything. No docstring, comment, confirmation, or user-facing log discloses this destructive behavior; the exception handler only runs after a failure.

Content

No source excerpt is available for this finding.

The request helper silently registers remote accounts and persists authentication credentials, beyond the declared video-analysis purpose.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

An ordinary HTTP request can initiate remote registration using silent and register flags, transmit the selected identity, and save returned credentials locally. These identity-management side effects are not disclosed by the video-analysis description and occur without an explicit enrollment step.

Content

No source excerpt is available for this finding.

HTTP requests can silently trigger remote user registration and identity transmission.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The request helper can automatically create a remote account and send an identity as both openId and mobile. This introduces undisclosed external state changes and identity disclosure into a skill described only as reptile-video analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

External transmission is not inherently unsafe, but this POST sends identity data to a registration endpoint as an automatic side effect of requesting another resource. The selected identity can come from API_SECRET_KEY, so this path may also transmit a configured secret as identity data rather than keeping it confined to authentication.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and files, including during module import.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

YamlUtil.load creates the parent directory and writes a YAML file when the requested configuration is absent, without a prompt, log, docstring, or explanatory comment. BaseEnum.init_subclass invokes this loader during class creation (L044–L059), so importing the module can modify the filesystem even when the caller only expects to read configuration.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally: