Pet Sneeze / Cough Detection | 宠物睡眠质量分析（时长/翻滚次数）

• Outcome: Review
• Latest audit: Aug 9, 2026 · 12:50 AM UTC
• Version: 1.0.7

Overview

The skill’s pet sleep analysis purpose is coherent, but it needs Review because it uploads sensitive media to cloud services while silently creating or reusing account identity and storing authentication tokens locally.

Review this before installing if your videos may show homes, people, clinics, or boarding facilities. The skill relies on remote services, can upload local files or process URLs, queries cloud report history, silently associates activity with an internal/default identity, and stores reusable auth tokens in a local workspace database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior and associated scripts require environment access, local file read/write, shell execution, and network communication. This mismatch weakens reviewability and informed consent, making it easier for a seemingly simple media-analysis skill to access local state and transmit data remotely without clear declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest describes a local pet sleep analysis function, but the underlying behavior includes identity harvesting from workspace/env sources, persistent local account records, backend login/token handling, and remote report management. That gap is dangerous because users may provide sensitive video believing it will be processed only for the stated purpose, while the skill actually performs broader identity-linked remote operations not transparently disclosed.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script exposes a history-listing capability via `--list` and `show_analyze_list(open_id)` that goes beyond the stated local/video sleep-analysis function. Because it is tied to per-user history and not clearly disclosed in the skill description, it creates an unnecessary data-access surface that could reveal prior analysis records if identity resolution is weak or misused.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code initializes an internal user identity with `OpenIdUtil.resolve_current_open_id(...)` and then uses `ConstantEnum.CURRENT__OPEN_ID` to fetch analysis history, despite the skill being presented as a video-analysis tool. Hidden identity binding for data retrieval is dangerous because it can silently associate execution with a user account and expose private historical records if the identity source is incorrect, spoofable, or not transparent to the user.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill accepts arbitrary http/https video URLs and forwards them to the backend for analysis, which expands the trust boundary beyond the advertised fixed-camera/local monitoring use case. This can enable unintended retrieval of third-party content, abuse of backend network access, or analysis of untrusted remote resources without clear restrictions.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill provides report listing and export-link generation functionality that goes beyond simple sleep-quality analysis output. If exposed to users or other agents without authorization checks at this layer, it may reveal prior analysis metadata or direct export URLs for reports unrelated to the current request.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script exposes history retrieval based on `open_id`, including a hidden `--open-id` parameter and list functionality, without any visible authorization checks in this file. In a consumer or multi-tenant context, account-scoped history access can enable unauthorized access to prior analysis records if `open_id` values are guessable, injected, or mishandled by downstream components.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This pet sleep-analysis skill includes a shared DAO with persistent user-account handling that is unrelated to the declared camera-based sleep-scoring purpose. Unnecessary identity persistence broadens the data-collection surface and creates avoidable privacy and credential-handling risk if the local database is exposed, reused by other skills, or accessed across shared workspaces.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The model stores identity fields plus token and open_token values even though the skill description is limited to analyzing pet sleep from a fixed camera. Persisting authentication-like tokens without clear necessity or protection creates a substantial credential exposure risk: compromise of the SQLite file could leak reusable secrets, enable account linkage, or facilitate unauthorized access to external systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility code performs backend account provisioning and remote login/token bootstrap behavior that is not justified by a pet sleep-quality analytics skill. In context, this is dangerous because installing or invoking an analytics skill can silently create identities, contact unrelated services, and establish authenticated backend access without clear user consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code creates or reuses backend user identities, fetches tokens, and stores them locally, which is a significant hidden capability for a skill whose stated purpose is video-based pet sleep analysis. This enables persistent authenticated access tied to local state and could be abused for tracking, impersonation, or unauthorized use of backend resources.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code inspects environment variables, filesystem layout, and agent workspace structure to locate data and skills directories. While not inherently malicious, this exceeds the apparent needs of pet sleep analysis and increases the skill's ability to map host/agent context and write into persistent workspace locations.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The default trigger is broad enough to auto-invoke analysis whenever a user provides related media, increasing the chance of unintended processing and upload of sensitive pet/home video. In this context, automatic activation is more dangerous because the skill also appears to use cloud APIs and local persistence, so an accidental trigger can cause unnecessary data exposure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill handles uploaded video, network URLs, cloud history queries, and remote reporting, but the description does not clearly warn users that media and metadata may be transmitted to and stored by cloud services. For home or hospital pet monitoring footage, this omission can expose sensitive environmental and behavioral data without meaningful user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The comment and code indicate hidden internal identity initialization that is not shown in normal help output and does not require overt user input. Undisclosed identity resolution is a privacy and security issue because users may believe they are only analyzing a file while the tool is also determining account identity and potentially enabling access to related backend data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads arbitrary local file contents into memory and transmits them to an external analysis service, but this file contains no user-facing consent, warning, or narrowing of what may be uploaded beyond extension/size checks. In a skill handling pet-monitoring video, those files may contain sensitive household imagery, making silent upload a privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Accepting an API key as a hidden command-line argument is risky because command-line arguments are often exposed via shell history, process listings, job logs, or debugging output. Hiding the option from `--help` does not protect the secret and may make operators less aware of the credential-handling risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code analyzes local files or remote URLs through a backend skill/API path without clearly informing users that video content may be transmitted off-host. Because the skill processes camera footage of pets in homes, hospitals, or boarding settings, undisclosed network transfer can create material privacy and compliance risk, especially if recordings include people, interiors, or sensitive operational environments.

Missing User Warnings

Medium

• Confidence: 70% confidence
• Finding: The save routine overwrites the target path unconditionally and suppresses all exceptions, which can hide failed writes, clobber existing configuration, or replace security-relevant settings without auditability. If an attacker can influence the path or config source elsewhere in the application, this behavior could facilitate destructive file overwrite or persistence of unsafe settings while masking operational evidence.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: FileUtil.open() opens an arbitrary caller-supplied path in write mode without validation, disclosure, or path restrictions. In a shared utility used by skills, this can enable unintended overwrites of local files if untrusted input reaches this method.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: Creating directories is not inherently dangerous, but this helper will create arbitrary paths without restriction or user disclosure. In a skill ecosystem, that can contribute to silent persistence or unexpected modification of the local workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads an identity value from data/smyx-api-key.txt and uses it as an internal identifier fallback without clear disclosure. This silently pulls local identity material into skill logic and can couple unrelated local secrets or identifiers to backend actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The helper automatically transmits identity-related fields such as openId, mobile, and source to a remote endpoint with no visible user-facing warning. For a pet sleep analysis skill, that creates an unnecessary privacy and account-linkage risk unrelated to the advertised functionality.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code sends HTTP requests carrying authentication tokens and user identifiers, and may also add tenant and platform metadata automatically. Because this is hidden in shared utilities for an analytics-oriented skill, it creates a substantial risk of undisclosed data exfiltration, account misuse, and cross-service tracking.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2