Back to skill

Security audit

Reptile Shedding Progress Analysis | 爬宠蜕皮进度识别

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it should be reviewed because it silently uses cloud services, local identity files, account bootstrap, and token persistence for a reptile image-analysis workflow.

Install only if you are comfortable with reptile images or videos being sent to the LifeEmergence cloud service, remote URLs being passed to that service, and the skill automatically using or creating an internal identity with locally cached tokens. Review or disable the account/bootstrap and history features if you need local-only analysis or explicit consent before cloud access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
72% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
72% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no explicit permissions while instructing use of shell execution, local file handling, environment access, and network-connected scripts. This creates a transparency and consent gap: a caller may invoke the skill expecting passive image analysis, but the skill can persist data locally and communicate with remote services without clearly declared capability boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest describes a bounded reptile-shedding analysis skill, but the documented behavior also includes remote history retrieval, account/login/token management, local SQLite persistence of internal identity, and broader media handling. This mismatch is dangerous because it hides materially different data flows and trust assumptions from users and orchestrators, increasing the chance of unintended data disclosure and over-privileged execution.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The history-listing mode exposes prior analysis results keyed by an internal/open user identity, but that capability is not disclosed in the stated shedding-analysis functionality. Undocumented record retrieval tied to identity can enable privacy leakage or unauthorized access to another user’s animal images/analysis history if identity resolution is weak or manipulated.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill initializes and uses internal user identity handling despite the task being simple reptile image analysis, creating unnecessary identity coupling. If the identity is resolved implicitly or reused across contexts, it can cause analyses and history to be associated with the wrong user or expose user-linked data without a clear need.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code accepts arbitrary http/https URLs and forwards them as `videoUrl` for backend analysis, even though the stated use case is a fixed local enclosure camera. This expands the attack surface and can enable server-side fetching of attacker-controlled URLs, which may be abused for SSRF-style access to internal resources or unauthorized retrieval of unexpected remote content, depending on backend behavior.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation materially diverges from the declared skill purpose: instead of fixed-camera reptile shedding image-phase analysis, it provides generic video analysis and history retrieval. This kind of scope mismatch is dangerous because users, reviewers, and policy controls may grant the skill permissions or trust assumptions based on the manifest, while the code actually enables broader media processing behavior than advertised.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Accepting arbitrary remote URLs expands the skill from local fixed-camera monitoring into general network-fetching behavior that is not justified by the stated use case. In practice, this can be abused to make the system process attacker-controlled content, access internal-only endpoints if downstream fetches occur server-side, or bypass expected trust boundaries around enclosure-captured media.

Context-Inappropriate Capability

Low
Confidence
83% confidence
Finding
The history-listing feature exposes access to prior analysis records outside the manifest's stated scope, creating an undocumented data-access surface. Even if intended for convenience, hidden or unreviewed listing functionality can leak sensitive media metadata or results to callers who were only expected to perform single-purpose shedding analysis.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The code and CLI present themselves as a generic video-analysis tool, contradicting the manifest's narrowly scoped reptile image-analysis purpose. This inconsistency is a security concern because operational reviewers and users may misunderstand what the tool can ingest and do, weakening oversight and increasing the chance that broader capabilities are deployed without proper review.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file exposes a broad, generic network/CRUD wrapper layer (page, list, add, edit, delete, arbitrary HTTP verbs) that is far wider than the declared purpose of reptile shedding image analysis. In a skill ecosystem, this kind of unnecessary capability increases the attack surface and can be repurposed to access or modify unrelated backend resources, especially because URLs and payloads are passed through with minimal restriction or validation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The get_user_by_username capability introduces user-account lookup functionality that is not justified by the skill's stated reptile shedding analysis purpose. Unnecessary identity lookup features can enable account enumeration, privacy leakage, or lateral misuse if an attacker or over-privileged workflow can query usernames through this skill.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements a generic DAO plus user-account persistence, including create, update, query, and delete operations for a local sys_user database. That capability is unrelated to reptile shedding image analysis and materially expands the skill's data-handling surface, creating unnecessary collection and mutation of account data that could be abused for unauthorized tracking, persistence, or cross-skill data access.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The User model stores identity and authentication-adjacent fields such as username, realname, email, token, and open_token, none of which are justified by a reptile enclosure monitoring skill. Unnecessary retention of such fields increases the risk of credential/token exposure, user profiling, and unauthorized account linkage if the local database is accessed or repurposed.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The utility reads workspace identity material from local files and automatically creates persistent local user identities that are unrelated to reptile shedding analysis. In the context of an image-analysis skill, this is dangerous because it silently expands scope into identity management and persistence, creating hidden state and possible unauthorized account linkage without informed user consent.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This code performs silent registration/login against external health API endpoints, including creating or retrieving accounts and caching tokens, which is far outside the stated purpose of reptile shedding progress analysis. The mismatch in scope materially increases risk because users would not reasonably expect enclosure images or routine skill use to trigger account bootstrap and authenticated external service interaction.

Vague Triggers

Medium
Confidence
88% confidence
Finding
A default trigger that activates on broadly provided reptile images or videos can cause unintended execution of this skill in contexts where the user did not request shedding analysis. Because the skill may save files locally and contact backend services, accidental invocation can lead to unexpected data processing and privacy-impacting side effects.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The historical report query trigger is defined using common reporting phrases, making it easy to invoke cloud-backed history access without sufficiently clear user intent. In a skill that auto-associates internal identity and queries remote records, overbroad triggers raise the risk of unnecessary disclosure of personal or sensitive usage history.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments are automatically saved as local files, but the overall description does not prominently warn users about this persistence behavior. Silent local storage increases privacy and retention risk, especially for media files that may reveal home environments or other incidental sensitive information.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Historical report queries are sent to a cloud API, but this outbound data flow is not surfaced as a prominent warning in the skill description. Users may reasonably assume local analysis only; hidden cloud access can expose metadata, identifiers, or report contents beyond expected boundaries.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code initializes an internal identity using a hidden parameter and comments indicate the user is not prompted and the option is suppressed from help output. Hidden identity resolution reduces transparency and can result in silent tracking, unexpected account linkage, or unauthorized access to user-scoped data, especially when combined with history-listing behavior.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill reads a local file in full and uploads its contents to the analysis service without any in-code disclosure, consent prompt, or visible warning to the caller. In a security-sensitive environment, this can lead to unintended exfiltration of local media or adjacent sensitive files if a user supplies the wrong path or does not realize the file is being transmitted off-host.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debug logging can emit full request/response details, potentially including tokens, identifiers, request bodies, and other sensitive data. Because this utility also manages authentication and external API calls, such logging can leak secrets into console output or log files accessible to other users or processes.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code reads identity-related data from OPENCLAW_WORKSPACE-derived paths and local key files without explicit disclosure or confirmation. In a reptile imaging skill, silently harvesting credential-like values from environment and filesystem is out of scope and can cause users to unknowingly operate under or expose an existing identity.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2