Back to skill

Security audit

Pet Sneeze / Cough Detection | 宠物打喷嚏/咳嗽检测

Security checks across malware telemetry and agentic risk

Overview

The skill broadly matches pet sneeze/cough analysis, but it quietly ties use to cloud processing, report history, account identity, and locally stored tokens, so it needs review before installation.

Install only if you are comfortable sending pet videos, optional audio, and remote media URLs to the configured cloud service, and with the skill creating or reusing an account identity, storing tokens locally, and retrieving cloud report history automatically. Avoid private/internal URLs and sensitive household footage unless those cloud and identity behaviors are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, environment-derived identity, and cloud/network access, but does not declare permissions or present user-facing consent boundaries. This creates a capability/expectation mismatch that can lead to unintended execution or data access without adequate review, especially when processing local files and querying cloud history APIs.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script initializes and uses an internal identity context and exposes a hidden history-listing path that is not necessary for local sneeze/cough detection. Because --open-id and --api-key are suppressed from help output, users may not realize identity-linked analysis history is being accessed, creating an unauthorized data access/privacy risk if a caller can influence or inherit another user's identity context.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The comment states that user identity input is not required or exposed, but the code still conditionally accepts a caller-supplied open_id. This mismatch can mislead reviewers and operators about how identity is sourced, increasing the chance of improper trust assumptions, weak auditing, or accidental cross-user access.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill accepts arbitrary http/https URLs and forwards them for backend analysis, which expands the capability from local/real-time pet monitoring to remote content fetching. This can create SSRF-like risk, unauthorized access to internal or sensitive media endpoints, and privacy issues if users or upstream systems can be induced to fetch attacker-controlled URLs.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The skill exposes historical report enumeration beyond the stated detection purpose, which can increase data exposure by surfacing prior analyses and associated export links. If access control is weak in the underlying page/export APIs, this functionality could enable privacy leakage or cross-tenant report discovery.

Description-Behavior Mismatch

Low
Confidence
76% confidence
Finding
The hidden `--list` capability exposes historical analysis data access that is not disclosed by the stated detection-focused skill description. Undocumented data-access features are dangerous because users and integrators may not realize the tool can enumerate prior records, increasing the risk of privacy violations and unauthorized data exposure.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
Accepting arbitrary remote video URLs expands the attack surface beyond local or real-time camera input and can enable server-side request forgery or unintended fetching of internal resources, depending on how `skill.get_output_analysis` retrieves the URL. In a health-monitoring skill, this is more concerning because the manifest suggests a narrower, camera-based use case, so integrators may not expect network retrieval behavior.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
This model stores identity and token-related fields (username, realname, email, token, open_token) that are not justified by the skill's stated sneeze/cough detection purpose. In a camera/audio pet-monitoring context, collecting and persisting such sensitive user data increases privacy and breach impact without clear necessity, making the mismatch more concerning.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file implements a generic AI chat/session wrapper instead of the pet sneeze/cough detection behavior promised by the manifest. This mismatch is dangerous because it creates a deceptive capability boundary: a skill presented as benign animal-health monitoring actually exposes general-purpose agent interaction logic, which can be repurposed for unintended actions, data handling, or prompt-driven behavior outside the declared scope.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The docstring states that the function invokes an external agent via subprocess, but the actual subprocess execution is fully commented out and replaced with placeholder behavior. This inconsistency is a security concern because it obscures the real execution path, hinders review, and can conceal later activation of risky command execution with little visibility; reviewers may incorrectly assess the trust boundary and data flow.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This utility code automatically provisions remote user accounts, retrieves tokens, and persists authentication material in local storage, which is unrelated to sneeze/cough detection. In the context of a pet-health skill, hidden identity creation and token handling materially expands scope and creates risk of unauthorized account activity, privacy leakage, and cross-skill abuse if compromised or invoked unexpectedly.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default trigger is broad enough to auto-activate on generic pet-video analysis requests, even when the user did not specifically request sneeze/cough detection or cloud-backed processing. Over-broad triggering can cause unnecessary file handling, script execution, and possible transmission of pet video data to external services without clear intent.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The history-report trigger uses broad phrases like viewing reports and mandates automatic cloud API queries, which can expose historical data based on ambiguous user intent. Because the skill also hides identity handling internally, a casual request could retrieve linked report history without sufficiently explicit authorization or context.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill omits a clear privacy warning that uploaded videos, optional audio, URLs, and report-history requests may be sent to or retrieved from cloud services. This is risky because the content may include sensitive household imagery, audio, and account-linked behavioral history, and users are not clearly informed before remote processing occurs.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code resolves a current internal open_id without clear user-facing disclosure, which means identity data may be collected or used implicitly during a health-monitoring workflow. In a pet-monitoring context, hidden identity binding increases privacy sensitivity because analysis records and history can become associated with a user account without transparent consent.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code reads arbitrary local file contents into memory and uploads them to an external analysis service without any visible user-facing disclosure or consent mechanism in this file. For a health-monitoring skill processing pet videos, this is sensitive because videos may contain homes, people, voices, or other private data beyond the pet itself.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The code resolves and uses a current `open_id` implicitly, then uses it to retrieve history without clear disclosure or consent at the CLI level. Hidden use of a persistent user identifier can create privacy risk, especially when combined with the undocumented listing feature that surfaces analysis history.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code silently reads an internal identity value from data/smyx-api-key.txt and uses it as an open-id fallback without user-facing disclosure. In a pet monitoring skill, undisclosed consumption of credential-like local files is out of scope and can lead to privacy violations, unintended account linkage, or unauthorized API usage under another identity.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code automatically performs remote authentication/registration using a constructed payload and no user-facing disclosure or consent flow. In a pet sneeze/cough detection skill, covert account creation and login behavior is unnecessary to core functionality and exposes users to hidden data sharing, account sprawl, and misuse of personal identifiers.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The general HTTP helper injects tokens, API keys, usernames, tenant codes, and platform metadata into outbound requests automatically, which can transmit sensitive context broadly without transparent user awareness. Because this is a generic utility in a narrowly scoped pet-health skill, the mismatch in scope makes the hidden exfiltration and cross-service identity use more concerning.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB;建议时长 ≥ 30 秒 |
| 🔎 使用提醒 | **含音频的视频可大幅提升检测准确率**,建议使用带麦克风的摄像头拍摄 |
| 🔎 使用提醒 | 摄像头需固定,视角覆盖宠物头部及胸腹部,移动拍摄可能影响检测效果 |
| 🧑‍⚖️ 结果性质 | **检测结果仅供行为观察参考,不提供医疗诊断**;频繁发作建议及时就医 |
| 🔎 使用提醒 | 宠物打哈欠、伸懒腰等动作可能产生误检,建议结合频次和连续性综合判断 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
Confidence
82% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-sneeze-cough-detection-analysis"
description: "AI-powered pet sneeze/cough detection from real-time camera (optional audio fusion). Analyzes head and thoracic-abdominal motion plus sound features to distinguish single occasional events (normal airway clearing) from continuous bursts (e.g. ≥3 sneezes/min, frequent dry/wet coughing) and records event time and frequency. Helps catch respiratory infection, allergy, or foreign-body irritation early. Scenarios: home health monitoring, animal hospital wards, pet boarding centers. | 通过宠物摄像头实时分析宠物头部和胸腹部的动作,结合可选的声音分析,识别宠物是否发生打喷嚏或咳嗽行为。区分单次偶发(可能是正常清理呼吸道)与连续发作(如频繁打喷嚏、干咳、湿咳等异常模式),并记录发生时间及频率。有助于早期发现宠物呼吸道感染、过敏或异物刺激。应用场景:宠物家庭日常健康监测、宠物医院住院观察、宠物寄养中心。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
84% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2