Back to skill

Security audit

Snake Stomatitis (Mouth Rot) Detection | 蛇类口腔腐肉识别(口炎)

Security checks across malware telemetry and agentic risk

Overview

This skill should be reviewed before installation because it sends snake mouth media to a cloud service while silently creating or reusing an identity and storing account tokens locally.

Install only if you are comfortable with uploaded files or provided URLs being processed by LifeEmergence cloud APIs and with the skill creating/reusing a persistent local identity plus stored tokens. Do not provide private/internal URLs, sensitive enclosure footage, or proprietary media unless that cloud processing and report history storage are acceptable. Review or clear the workspace data used by this skill if you later uninstall it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to use shell execution, local file save/read/write, environment-backed identity handling, and network/API access, but no explicit permissions are declared in the manifest. This creates a capability-transparency gap: operators and policy engines cannot accurately assess that user files may be persisted locally and sent to a remote service before execution.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill exposes a history-listing function that is unrelated to the stated purpose of analyzing snake oral images. Expanding scope from single-item analysis to retrieval of prior analysis records increases the chance of unauthorized access to stored user data or medical-like animal health history, especially because the listing is keyed off an internal identity rather than explicit user-supplied authorization.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code resolves an internal open_id even though the advertised function is visual analysis, creating hidden identity coupling and potential access to backend user-scoped data. This becomes dangerous because the same internal identity is then used for the history-listing path, enabling possible privacy violations or cross-user data exposure if identity resolution is weak, implicit, or attacker-influenced.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill’s declared purpose is fixed-camera snake mouth image analysis, but the implementation accepts both whole local video files and arbitrary remote video URLs for backend processing. This expands data intake beyond the stated scope, increasing privacy and misuse risk because users or upstream callers can submit unrelated media or cause the backend to retrieve external content not implied by the manifest.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code forwards arbitrary http/https URLs to the backend as video sources, enabling analysis of any network-hosted content rather than only enclosure-camera captures. If the backend dereferences these URLs, this can enable server-side fetching of attacker-controlled destinations, creating SSRF-like risk, unexpected data access, or abuse of backend network reachability.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The implementation materially diverges from the declared skill purpose: instead of a narrowly scoped snake-mouth image detector, it acts as a generic video-analysis wrapper and delegates processing to an external skill method with little validation. This kind of scope mismatch is dangerous because it can mislead users and reviewers about what data is collected, transmitted, and processed, enabling hidden or broader-than-declared behavior under a benign medical/veterinary description.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The history-listing feature is unrelated to the stated detection task and expands the skill's effective capabilities into data retrieval. In a system handling animal health imagery or user-associated analysis jobs, an unnecessary listing function can expose prior analyses, metadata, or identifiers beyond the principle of least privilege.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The CLI advertises generic video analysis while the manifest claims high-definition image-based stomatitis detection, creating a misleading interface and inconsistent trust boundary. This discrepancy increases the chance that operators supply broader data than intended and that security/privacy review misses the true data types and processing behavior.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This file exposes broad generic API capabilities including list/add/edit/delete and arbitrary HTTP GET/POST/PUT/DELETE wrappers that are not scoped to the stated snake stomatitis detection purpose. In an agent-skill context, such overbroad network primitives can be repurposed to send, modify, or delete remote data outside the intended workflow, increasing the attack surface and enabling unintended external actions.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The implementation is a reusable remote API client rather than code specific to image capture or stomatitis analysis, which materially differs from the declared skill purpose. This mismatch is dangerous because disguised generic network tooling inside a specialized skill can facilitate hidden data exfiltration or remote control functions that users and reviewers would not expect from the advertised medical-analysis use case.

Context-Inappropriate Capability

Medium
Confidence
72% confidence
Finding
This code stores and manages identity and token-related fields (token, open_token, email, realname) despite the stated purpose being medical image analysis for snakes. In a least-privilege review, unexplained collection of account and token data increases the blast radius of compromise and creates unnecessary exposure of sensitive information if the database file is accessed by other skills or actors in the shared workspace.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility performs remote account provisioning, token acquisition, token persistence, and authenticated API request handling that are unrelated to snake oral-image diagnosis. In a medical-imaging style skill, hidden login/registration behavior materially increases risk because it can transmit identifiers, create backend accounts, and couple skill execution to undisclosed external services.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads identity material from workspace files, falls back to local database records, and generates synthetic user identities when none exist. That behavior is unrelated to the declared function of analyzing snake mouth images and creates a covert identity layer that can later be used for remote API activity without user awareness.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The utility contains broad agent workspace discovery and writable filesystem management capabilities that exceed what is needed for oral-image diagnosis. While not directly exploitative by themselves, these functions enlarge the skill's access surface and can facilitate unauthorized data access, persistence, or cross-agent contamination if other code misuses them.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default trigger is broad enough to auto-invoke this skill for essentially any snake mouth image/video analysis request, even when the user may not intend cloud-backed medical-style processing. Over-broad invocation increases the chance of accidental handling of sensitive media, unintended shell/script execution, and unexpected data transmission.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The history-query trigger uses broad natural-language phrases to automatically call a cloud API for report retrieval. Without tighter scoping, normal conversational requests can cause unintended access to historical records tied to an internal identity context.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill states that uploaded attachments are automatically saved locally and that URLs are processed via an API service, but the description lacks a clear, prominent warning to users that local files and remote URLs will be transmitted to a cloud/API backend. This undermines informed consent and may expose sensitive images, metadata, or internal URLs unexpectedly.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill reads local file contents into memory and submits them, or sends remote video URLs for analysis, without any visible consent, warning, or disclosure in this code path. For a health-related animal-analysis workflow, this can cause unintended transfer of sensitive or proprietary media and makes data handling less transparent to users and integrators.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code accepts local files or remote URLs and sends them for analysis via delegated API-backed functionality without any user-facing disclosure or consent prompt about external transmission. In this context, veterinary imagery and associated metadata may be sensitive operational data, so silent upload or third-party processing creates privacy and compliance risks.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The delete method performs an arbitrary HTTP POST-based delete action with no visible confirmation, safety guardrails, or endpoint restriction. In an agent setting, this creates risk of silent destructive remote operations if the method is invoked on attacker-influenced inputs or misused by surrounding code.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code persists a generated identity into local storage/database without any visible notice or consent flow. Silent identity creation and retention can surprise users, create undeclared tracking state, and support later authenticated network activity under a synthetic account.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The utility reads identity-related material from a workspace API-key file without any visible disclosure. Even if intended for convenience, silent ingestion of local identity material can violate user expectations and enable downstream authenticated requests under credentials the user did not knowingly provide for this skill.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code performs login/registration requests using identity data with no user-facing warning. In the context of a snake stomatitis detection skill, such undisclosed account actions are especially concerning because users would not reasonably expect health-image analysis to create or authenticate remote accounts behind the scenes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2