Back to skill

Security audit

Reptile Tail Loss (Autotomy) Detection | 守宫/蜥蜴尾巴断尾识别

Security checks across malware telemetry and agentic risk

Overview

The skill matches its reptile-image analysis purpose, but it also automatically creates or reuses identity, uploads media, queries cloud history, and stores tokens locally with limited user control.

Review before installing. Use this only if you are comfortable sending reptile enclosure images or videos and related account metadata to the configured LifeEmergence services, allowing a local workspace database with identity and tokens, and relying on cloud history retrieval. Avoid using sensitive household footage unless the publisher provides clearer consent, retention, and deletion controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet its documented behavior includes shell execution, filesystem access, environment use, network calls, and local writes. This undermines least-privilege expectations and can mislead operators into approving a skill that can persist data locally and exfiltrate user-supplied content or metadata to backend services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The manifest presents this as a narrow image-analysis skill, but the documented behavior expands into persistent identity creation, token acquisition, backend record listing, and remote processing. This mismatch prevents informed consent and security review because reviewers may approve animal-image analysis while the skill actually performs account-style operations and stores identifiers locally.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script exposes a history-listing function via `--list` that retrieves prior analysis records by internal user identity, but this capability is not reflected in the stated skill purpose, which is image-based tail-loss detection. Hidden or undocumented data-retrieval features increase the risk of unauthorized access to historical records, especially because the code also initializes internal identity state before serving the request.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code resolves and relies on an internal `open_id` even though the skill is presented as a simple media-analysis tool. Introducing hidden identity handling expands the privacy and access-control surface, and in combination with the history-listing path it could allow user-linked data retrieval or cross-user record exposure if identity resolution is weak or implicit.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The implementation materially diverges from the declared skill purpose: the manifest describes reptile tail-image analysis, but the code exposes a generic video-analysis and history-listing workflow. This mismatch is dangerous because users, reviewers, or policy controls may grant trust and permissions based on the stated animal-health use case while the actual code processes broader media inputs and retrieves historical analysis data, creating a deception and scope-expansion risk.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The CLI text and function documentation explicitly advertise generic video analysis, which contradicts the manifest's image-based reptile tail-loss detection description. Inconsistent documentation increases the chance of unsafe deployment, incorrect reviewer assumptions, and misuse of the skill in environments where only the narrower declared functionality was approved.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This file exposes a broad, generic API wrapper with create/edit/delete and raw HTTP GET/POST/PUT/DELETE methods that are not constrained to the stated tail-image analysis purpose. In an agent skill context, such unconstrained network and modification primitives can be repurposed to interact with arbitrary backend endpoints or alter remote resources, expanding capability well beyond the manifest and increasing abuse potential if the skill or its callers are influenced by untrusted input.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The presence of add, edit, delete, and generic POST-based page/list operations gives the skill remote resource modification capability that is not justified by a primarily observational, camera-analysis workflow. Because the skill’s declared purpose is detection and event recording, these mutation-capable helpers create unnecessary attack surface and could be abused to change or create remote data if higher-level code passes attacker-controlled URLs or payloads.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file defines a generic user-account model and DAO that store usernames, real names, email addresses, birthdays, tokens, and open tokens, which is unrelated to reptile tail-loss image analysis. This unnecessary identity and token persistence expands the skill's data collection and breach surface, especially because the manifest only describes visual detection and event recording.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
This module implements a broad reusable database layer with path rewriting, generic CRUD, and schema management that goes beyond the stated purpose of detecting tail-loss events and recording event times. Such overbroad persistence capability increases the chance of collecting or modifying unrelated data and creates a larger attack surface than the skill description suggests.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This utility file contains account provisioning, token persistence, remote login, and authenticated API request logic that is unrelated to reptile tail-loss image analysis. In the context of a narrowly scoped animal-health skill, bundling hidden identity, token, and remote-account behavior materially expands the attack surface and enables undisclosed network-side actions under user or workspace identity.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code reads an internal identity from `data/smyx-api-key.txt`, falls back to local database records, and if none exist automatically creates a default user identity. For an enclosure-camera tail-loss detection skill, silently sourcing or generating platform identities is unjustified and dangerous because it can impersonate a user/workspace and trigger downstream authenticated actions without meaningful user awareness.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The utility detects agent workspace roots, enumerates installation context, and creates data/skills directories. That is broader than needed for reptile image analysis and grants the skill awareness of host layout plus the ability to write into agent-controlled locations, increasing the risk of unauthorized persistence, cross-skill interference, or data exposure if misused.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger activates on broadly defined lizard/gecko tail image analysis requests, which can cause the skill to run in unintended contexts. Overbroad activation increases the chance of unnecessary file handling, network transmission, and backend lookups on user content that did not require this specific skill.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments are automatically saved as local files without clear user-facing disclosure or retention controls. Even if the images are of animals, they may contain household background, timestamps, location clues, or operational metadata, creating avoidable privacy and data-retention risk.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill reads arbitrary local file contents and transmits them to an external analysis service via the `files` parameter, but this file provides no user-visible consent, warning, or limitation beyond extension and size checks. In a security-sensitive environment, this can lead to unintentional disclosure of local media or mislabeled sensitive files to a remote service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
When debug mode is enabled, low-level HTTP debugging and urllib3 logging are turned on globally, which can expose request URLs, headers, payloads, and response contents. Because this file later handles tokens and identity-bearing requests, debug logging can leak credentials and sensitive operational data to logs without user-facing notice.

Missing User Warnings

Low
Confidence
96% confidence
Finding
Reading identity data from a workspace file without explicit user action is privacy- and security-relevant, particularly because the value is later used to authenticate remote requests. In a reptile tail-loss analysis skill, this hidden identity harvesting is out of scope and increases the chance of unintended impersonation or secret reuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request helper automatically injects app ID, tokens, API keys, authorization tokens, tenant codes, skill metadata, and user identity into outbound requests. For a camera-based animal-health skill, silently transmitting identity and auth context to remote services creates significant privacy and account-abuse risk, especially when combined with the earlier auto-discovery and auto-provisioning logic.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
In debug mode the code logs request parameters, payloads, and full response bodies around authenticated HTTP operations. Even though headers are partly truncated for one print path, payloads and responses may still contain personal data, tokens, or sensitive service outputs, making log leakage a realistic risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-reptile-tail-loss-detection-analysis"
description: "Through fixed enclosure cameras, the system periodically captures tail images of geckos and lizards and uses AI visual analysis to detect tail length (compared with historical images or body-length reference values), tail-tip wounds, scabs, or abnormal shortening. | 通过爬宠箱固定摄像头,定期拍摄守宫、蜥蜴等爬行动物的尾部图像,利用 AI 视觉分析技术检测尾巴长度(与历史图像或同体长参考值对比)、尾部尖端伤口、结痂或异常短缩。当检测到尾巴长度突然明显缩短(例如缩短超过 20%)、尾部断端可见伤口或结痂时,输出'断尾事件'提示,记录发生时间。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
81% confidence
Finding
description:; ‍; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2