Snake Stomatitis (Mouth Rot) Detection | 蛇类口腔腐肉识别（口炎）

• Outcome: Review
• Latest audit: Sep 22, 2026 · 3:03 PM UTC
• Version: 1.0.11

Overview

The skill mostly matches its snake-mouth analysis purpose, but it silently creates or reuses an account identity, stores tokens locally, and can automatically query cloud history, so it belongs in Review before installation.

Install only if you are comfortable with snake mouth images/videos and report history being processed by the configured lifeemergence.com cloud service, and with the skill creating or reusing a local identity and storing remote auth tokens in the workspace. Use a separate workspace/account for testing, avoid sensitive media unless you trust the provider, and ask the publisher for token retention, deletion, and explicit-confirmation controls before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines several high-risk undeclared behaviors: local file reads/writes, installation-path and workspace detection, user/open-id creation or retrieval, token storage, and outbound authenticated HTTP requests. In a healthcare-adjacent media-analysis context, concealed identity and token handling plus remote exfiltration pathways substantially elevate privacy and platform risk.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-snake-stomatitis-detection-analysis"
description: "Through fixed enclosure cameras, the system captures high-definition images of the moment a snake opens its mouth (yawning, post-feeding, or oral examination) and uses AI visual analysis to detect oral mucosa color (normal pink, mild inflammation red, severe inflammation dark-red or pale), the presence of pus points (white or yellow dots), ulcers, or necrotic tissue (irregular depressions, necrotic patches), comprehensively. | 通过蛇箱固定摄像头，捕捉蛇张口（打哈欠、进食后或口腔检查）时的瞬间高清图像，利用 AI 视觉分析技术检测口腔�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The module implements broad local database path handling, generic CRUD, and schema migration logic far beyond the manifest's stated image-analysis behavior. Such hidden persistence infrastructure is dangerous because it enables silent storage and mutation of arbitrary local data without clear necessity, especially in a narrowly scoped medical-image assessment skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file defines generic user-account persistence, including identity and token-bearing fields, which is materially unrelated to the declared snake stomatitis image-analysis purpose. In a skill context, unexplained account-management capability increases the attack surface for hidden data collection, retention, and misuse of user identity data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores token and open_token fields even though the skill's stated function is visual analysis of snake oral images. Retaining authentication-like secrets in a local SQLite database is high risk because compromise of the workspace or misuse by other code could expose reusable credentials unrelated to the promised feature.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer performs account bootstrap, token handling, authenticated API calls, and payment-related flows that are unrelated to the declared purpose of snake-mouth image analysis. That scope mismatch is dangerous because it quietly expands the skill from local/visual analysis into identity management and networked account operations, increasing the chance of undisclosed data transfer, credential misuse, and unintended backend actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code calls /sys/phoneLogin with register=1 and sends openId/mobile values derived from the username, effectively creating or logging into remote accounts automatically. For a stomatitis image-analysis skill, this is unjustified and creates a hidden identity-registration channel that could enroll users or devices in backend systems without meaningful awareness.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The insufficient-balance response returns detailed end-user instructions entirely in Chinese, and the file provides no alternative locale or opt-in mechanism. This is a clear natural-language locale constraint in user-facing behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and operationalizes shell, filesystem, environment, and network-capable behavior but does not declare any explicit tool scope or permissions boundary in the manifest. This creates an opaque trust boundary where an agent may execute file, network, or shell actions beyond what a user would reasonably infer from the medical-imaging description.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger is broad enough that ordinary discussion plus any snake mouth image/video may invoke the skill automatically. Over-broad invocation can cause unintended processing, local saving, or remote transmission of files without sufficiently specific user intent.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The history-query trigger uses broad natural-language phrases and auto-runs a cloud lookup for prior reports. This can expose sensitive historical records or cause unexpected remote access when a user is merely asking general questions about reports.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that uploaded attachments or media files are automatically saved locally, but does not provide a clear user-facing warning or retention/handling details at the point of use. Silent persistence of media, especially medical or animal-health records, increases privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill mandates direct cloud API queries for historical reports without clearly warning users that their data will be retrieved from a remote service. Lack of transparent disclosure undermines informed consent and can surprise users about cross-system data access.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing header string is hardcoded in Chinese ("蛇类口腔腐肉识别（口炎）结构化结果") with no indication that language selection is configurable or optional. This can violate language/locale policy when the skill is used in environments where users have not opted into Chinese output.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script exposes a history-listing capability via `--list` that retrieves prior analysis records by `open_id`, which goes beyond the stated purpose of analyzing a provided image/video for snake stomatitis. This creates an unnecessary data-access surface and can expose prior user activity or analysis results if access control in downstream components is weak or misconfigured.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2