Fish Flashing & Scraping Detection (Ectoparasite Warning) | 爬宠体温调节行为识别（晒点/躲避）

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:02 PM UTC
• Version: 1.0.6

Overview

The skill’s reptile-video analysis purpose is real, but it also automatically creates or reuses a cloud-linked identity and stores authentication tokens locally with limited user control.

Install only if you are comfortable sending reptile enclosure videos or video URLs to the Life Emergence cloud service and allowing the skill to create/reuse a local cloud-linked identity. Review how to delete local data/tokens and cloud reports before using sensitive footage or shared workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill manifest exposes effective capabilities for environment access, local file read/write, network access, and shell execution without declaring permissions or surfacing those powers to users. That creates a trust and policy gap: the skill can persist data, invoke scripts, and contact remote services in ways not obvious from the manifest, increasing the chance of unauthorized data handling or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is reptile behavior analysis, but the skill also performs identity persistence, token acquisition, remote account-style operations, and historical report retrieval tied to a user identity. This hidden expansion of scope is dangerous because users may provide animal videos expecting local analysis while the skill silently creates persistent identities and accesses prior account-linked data.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill accepts arbitrary http(s) video URLs and forwards them to the backend analysis API, even though the skill is described as operating on fixed enclosure camera footage. This expands the trust boundary and can enable server-side fetching of attacker-controlled URLs, creating SSRF-style risk, unexpected third-party access, or policy/scope bypass depending on how the downstream API retrieves the media.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is described as performing thermoregulation behavior analysis on enclosure-camera video, but it also exposes a history-listing capability tied to a user/open_id. That expands the feature from content analysis into account-linked record retrieval, which can disclose prior analysis metadata or results beyond the stated purpose and violates least-privilege expectations.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest suggests analysis of fixed enclosure-camera inputs, but the code accepts arbitrary remote URLs and forwards them to the backend analysis path. This broadens the input trust boundary and can enable analysis of unintended external content, backend fetching of attacker-controlled URLs, and privacy or SSRF-style risks depending on how downstream services retrieve the media.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The script resolves a current open_id context and uses it when listing analysis records, introducing account-scoped data handling not clearly necessary for simple video analysis. In a skill whose declared function is animal behavior processing, hidden identity linkage increases the chance of unauthorized data exposure, cross-user confusion, or unnecessary collection of user-associated information.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file exposes a generic service wrapper with broad add/edit/delete/list and raw HTTP verb helpers that accept caller-supplied URLs, which is far wider than the declared reptile thermoregulation video-analysis purpose. In an agent/skill environment, such reusable network primitives can be repurposed to access unrelated internal or external services, increasing the attack surface and enabling capability creep beyond the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The http_post/http_put/http_get/http_delete methods forward arbitrary URL arguments directly to the request layer without visible restriction, creating an unrestricted outbound request primitive. In a hosted agent context this can enable SSRF-style access to internal services, data exfiltration to attacker-controlled endpoints, or use of the skill as a proxy, and the reptile-analysis context does not justify this capability.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file contains generic user-account persistence logic, including lookup, creation, and reuse of default users, which is unrelated to reptile thermoregulation video analysis. In an agent skill, unexplained identity-management capability expands the attack surface and creates unjustified access to personal/account data, increasing the chance of covert collection, misuse, or privilege confusion.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The User model stores identity data plus authentication-like secrets such as token and open_token, but the stated skill purpose only concerns reptile enclosure video behavior analysis. Collecting and persisting tokens without a clear need is dangerous because compromise of the local SQLite DB would expose reusable credentials or linkage identifiers unrelated to the advertised function.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This skill declares a generic `ai_chat` capability in a module for reptile thermoregulation video analysis, which is broader than the stated manifest purpose and creates an unnecessary execution path for arbitrary prompt handling. Even though the current implementation is stubbed, the presence of this interface increases the attack surface and suggests the skill could be repurposed to process unrelated or sensitive inputs without clear authorization boundaries.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility implements broad authenticated HTTP access, token handling, account lookup, token refresh/retry behavior, and user provisioning logic that is unrelated to reptile thermoregulation video analysis. In the context of a narrowly scoped animal-behavior skill, this hidden general-purpose platform access greatly expands capability and enables collection/transmission of identifiers and authenticated actions against external services beyond the advertised purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can generate default user identities and persist them locally when no explicit identity is supplied, which is unrelated to the stated reptile-monitoring function. Silent creation or reuse of identities increases the risk of unauthorized account linkage, tracking, and external service use under a synthetic or implicit user context.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The workspace/environment inspection utilities enumerate agent context, workspace roots, skills directories, and data directories, capabilities not needed for reptile behavior analysis itself. In an agent ecosystem, such discovery logic can facilitate lateral awareness of host layout and make subsequent data access or persistence easier than the skill description suggests.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Default-triggering the skill on any reptile-camera video URL or file is overly broad and can cause analysis or external processing without a clear, specific user request. In a skill that can save files locally and call remote services, ambiguous activation materially increases the risk of unintended data processing and disclosure.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The keyword trigger includes broad health and behavior terms like lethargy, stress, and reptile behavior, which can match many unrelated user requests. Because the skill can perform local storage and remote operations, this ambiguity can lead to unintended invocation and processing of sensitive media or health-adjacent information.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Automatically triggering historical report queries from broad report-related phrases is risky because it can fetch cloud-linked prior records without sufficiently clear user authorization. In context, this is more dangerous because the skill also auto-associates an internal identity and queries remote APIs, so ambiguous wording could expose prior report metadata or URLs unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that uploaded attachments and video/image files are automatically saved to local storage, but it does not provide a clear user-facing warning or consent mechanism for that data handling. Since the inputs are continuous enclosure videos and possibly URLs, silent local persistence creates privacy, retention, and unauthorized access risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script resolves an internal user identity via `OpenIdUtil.resolve_current_open_id(...)` while suppressing the relevant CLI argument from help output, which reduces transparency around collection or use of identifier data. In a video-analysis context tied to historical report retrieval, hidden identity resolution can cause privacy issues, account confusion, or unauthorized access to another user’s analysis history if identity binding is weak elsewhere in the stack.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code logs the full `prompt` in debug output, which can expose sensitive user content, system instructions, API data, or secrets embedded in prompts to logs and operators. In an agent context, prompts often contain high-value data, so this creates a real confidentiality risk even if debug mode is only intermittently enabled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Debug mode enables low-level HTTPConnection and urllib3 logging, which can expose request URLs, payloads, headers, and possibly tokens or user identifiers in logs. Because this utility also handles authentication and account provisioning, verbose logging materially increases the chance of credential or sensitive data leakage.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code reads an identity/credential-like value from data/smyx-api-key.txt and treats it as an internal identity source without clear validation or user disclosure. While not an exploit by itself, silently consuming workspace-stored identifiers can cause unintended identity reuse and broaden access without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Authenticated requests attach App-Id, access tokens, API keys, authorization tokens, tenant data, skill hub metadata, and user identifiers, while also auto-populating these values and sending them to external endpoints. For a reptile-camera analysis skill, this undisclosed authenticated transmission is broader than expected and increases privacy and account-risk exposure if endpoints, logs, or dependencies are compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

| 🔎 使用提醒 | **4 级提醒策略递进**（info → important → urgent → critical），侧重环境优化与福利改善 |
| 🔎 使用提醒 | 单日提醒上限：Level 1 不限 / Level 2 × 3 / Level 3 × 4 / Level 4 不设上限 |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **🚨 禁止**做"代谢性骨病 / 呼吸道感染 / 寄生虫感染 / 应激综合征 / 消化停滞"等具体疾病诊断 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案 |
| 🔎 使用提醒 | **禁止**长期存储完整爬宠箱视频（≤ 14 天，留温区利用时间序列 + 关键行为片段；养殖场按管理规定） |
| 🔎 使用提醒 | **禁止**用于商业广告 / AI 训练；禁第三方共享 |

• Confidence: 76% confidence
• Finding: ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2