Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its reptile tail-analysis purpose, but it silently creates or reuses a cloud-linked identity and stores service tokens locally, so it should be reviewed before installation.
Install only if you are comfortable sending reptile images, videos, URLs, and linked report-history requests to the lifeemergence cloud service. Review how the workspace data directory is protected, because this skill can create a local database and store service tokens there. Prefer an explicit consent step for cloud history lookup and account creation before using it with sensitive media.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
The combination of remote authenticated API communication, automatic open-id generation/account provisioning, local workspace reads/writes, and hidden identity linkage is substantially broader than the stated animal-image analysis function. This is dangerous because it couples sensitive media processing with persistent identity and storage operations that users are instructed not to see or control.
A metadata-poisoning indicator in the manifest is suspicious because tool/skill metadata is a high-trust channel that can influence routing, tool selection, and reviewer assumptions. Even if the embedded characters are subtle, anomalous or obfuscated metadata in a skill already showing scope mismatches raises the risk of deceptive packaging or parser confusion.
---
name: "smyx-reptile-tail-loss-detection-analysis"
description: "Through fixed enclosure cameras, the system periodically captures tail images of geckos and lizards and uses AI visual analysis to detect tail length (compared with historical images or body-length reference values), tail-tip wounds, scabs, or abnormal shortening. | 通过爬宠箱固定摄像头，定期拍摄守宫、蜥蜴等爬行动物的尾部图像，利用 AI 视觉分析技术检测尾巴长度（与历史图像或同体长参考值对比）、尾部尖端伤口、结痂或异常短缩。当检测到尾巴长度突然明显缩短（例如缩短超过 20%）、尾部断�
The implementation materially diverges from the declared purpose: instead of specialized reptile tail-image monitoring, it exposes a generic video analysis and history-listing interface. This kind of scope mismatch is dangerous because it can conceal broader data processing behavior than users or reviewers expect, weakening trust boundaries and enabling misuse of the skill for unrelated surveillance or content analysis.
This module defines a generic shared user-account DAO with identity fields and token storage that are unrelated to reptile tail-loss image analysis. In the context of a narrowly scoped animal-health skill, hidden cross-skill user persistence materially expands data collection and attack surface beyond user expectations, increasing the risk of unauthorized tracking, credential mishandling, and privilege boundary erosion.
The User model stores token and open_token fields even though the skill’s declared purpose is enclosure-camera tail injury detection. Storing authentication-like secrets in a local shared SQLite database without purpose limitation or protection increases the chance of credential leakage, replay, or unauthorized reuse across skills.
This utility implements identity selection, persistence, and automatic creation of default user identifiers, including reading an internal identity value from a local file and storing user records in a local database. That behavior is unrelated to reptile tail-loss image analysis and expands the skill into covert account-context management, increasing privacy and misuse risk if invoked without explicit user consent.
The HTTP wrapper does much more than issue application requests: it resolves user identity, loads and persists tokens, retries authorization, updates local user records, and injects user metadata into outbound requests. For a reptile-tail analysis skill, this broad remote account/token management is unnecessary and creates a hidden capability for external service coupling, user tracking, and unauthorized account actions.
The code can silently register or log in a user against an external health-service endpoint using a generated or recovered identifier, then retrieve tokens. Auto-registering accounts on a third-party service is highly sensitive behavior and is not justified by the declared purpose of detecting reptile tail injuries from enclosure images.
The skill declares no explicit tool scope even though the documented behavior requires shell, network, file, and environment access. This creates excessive implicit privilege and makes it harder for a host system to enforce least privilege or detect abuse if the skill is repurposed or the backing scripts behave unexpectedly.
The documentation expands the skill from image analysis into cloud history retrieval and report-link delivery, broadening access to remote user-associated data beyond the manifest's core purpose. Scope expansion in documentation is dangerous because it can smuggle in extra data flows and permissions without clear review boundaries.
The document claims not to provide medical advice while also directing the system to output care actions such as isolation and wound-cleaning guidance. Contradictory instructions are risky because they blur safety boundaries, can mislead users about the authority of the output, and may hide higher-liability behavior behind softer wording.
The default trigger is broad enough to auto-invoke on many reptile-tail image requests, which can cause unintended processing, file saving, or remote API submission without sufficiently specific user intent. In a skill that also performs identity-linked history access and external network calls, over-triggering increases privacy and misuse risk.
Automatically saving uploaded files locally without a clear user-facing data-handling notice creates avoidable privacy and retention risk. Media may contain sensitive context, and silent persistence expands exposure if the host or workspace is later accessed by other tools or users.
The skill instructs direct cloud API queries for history tied to internal identity without a prominent upfront warning that user-associated report data will be fetched remotely. Hidden remote retrieval of linked records is especially sensitive here because the skill also auto-handles identity and discourages exposing those identity values to the user.
The file prohibits local-history use while simultaneously describing local default-user reuse and local file saving. This contradiction is dangerous because it obscures what state is persisted locally and undermines privacy assurances about where identity-linked report data comes from.
Detected: suspicious.install_untrusted_source