Back to skill

Security audit

Turtle Pneumonia Symptom (Open-Mouth Breathing) Detection | 龟类张嘴呼吸(肺炎征兆)识别

Security checks across malware telemetry and agentic risk

Overview

This skill can analyze turtle media through a remote service, but it also silently creates or reuses an identity, stores access tokens locally, and can query cloud report history.

Install only if you are comfortable with turtle videos or video URLs being sent to Life Emergence endpoints and with the skill creating or reusing a local identity, storing service tokens in the workspace data directory, and fetching cloud report history. Review or clear `data/smyx-api-key.txt` and the local SQLite database if you do not want this skill linked to an existing identity.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares itself as a simple turtle symptom-detection capability, but the documented workflow requires shell execution, network access, local file reads/writes, and use of environment-like identity/config handling without any explicit permission declaration. This mismatch increases the chance that a host agent will grant broader capabilities than users expect, enabling unnecessary data access and command execution paths.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest presents the skill as media symptom detection, but the body also includes cloud history-report queries and report-link retrieval. This is a scope mismatch that can mislead users and orchestrators about what data flows occur, especially when medical-like observations and identifiers may be sent to a remote service.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill adds automatic cloud API history lookup behavior that is not necessary for the core task of analyzing current turtle video for symptoms. Unrelated remote querying expands the attack surface and creates avoidable privacy/data-minimization risk by pulling additional records and metadata into the session.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The workflow states that the system will silently reuse or auto-create a local default user identity when no upstream identity is provided. Silent identity creation and reuse can cause cross-user data mixing, unintended account linkage, and unauthorized access to historical reports or stored medical-adjacent records.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill exposes a history-listing function (`show_analyze_list`) that retrieves prior analysis results by `open_id`, which goes beyond the declared purpose of single-video symptom detection. This creates unnecessary access to historical user-associated data and can enable privacy leakage or unauthorized enumeration of prior analyses if identity controls are weak elsewhere in the stack.

Description-Behavior Mismatch

Low
Confidence
75% confidence
Finding
Accepting arbitrary remote URLs expands the trust boundary from local fixed-camera video input to network-retrieved content, which is not described in the skill metadata. While this file does not itself fetch the URL, passing unvalidated remote locations downstream can enable SSRF-like behavior, unexpected external access, or analysis of attacker-controlled content in underlying components.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code initializes and uses an internal `open_id` for operations unrelated to the core symptom-detection task, introducing identity handling into a media-analysis utility without clear necessity. This increases the risk of silent user tracking, cross-user data access, or coupling analysis operations to internal account state in ways the user does not expect.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary http/https URLs and forwards them to the backend analysis service, which expands the capability beyond the stated fixed-camera turtle-enclosure use case. This creates a scope mismatch and can enable analysis of unintended third-party or sensitive remote content, increasing privacy and misuse risk.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill exposes report listing and export-link generation features that are not part of the manifest's stated symptom-detection purpose. Extra capabilities like enumerating prior reports and generating export URLs increase the attack surface and may expose historical analysis data beyond the expected function of the skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Historical report enumeration is not justified by the turtle symptom-detection workflow and may allow access to prior analysis metadata or results. In a health-monitoring context, retaining and exposing historical reports without clear access controls can leak sensitive operational or animal-health information.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
This file exposes a broad, generic API client with arbitrary GET/POST/PUT/DELETE and CRUD-style helpers that are not justified by the stated turtle symptom-detection purpose. In a narrowly scoped skill, this materially expands the attack surface and enables the skill or dependent code to interact with unrelated backend endpoints, which could be abused for unauthorized data access, modification, or exfiltration if attacker-controlled inputs reach these methods.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The get_user_by_username capability introduces user-account lookup behavior unrelated to turtle pneumonia detection. In this context, it creates unnecessary access to identity information and can support account enumeration or privacy violations if exposed through the skill or reused by other components.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file contains a reusable user/account DAO with persistence for identities rather than functionality tied to turtle video symptom detection. In this skill context, unrelated account-management code materially increases attack surface, creates unnecessary data collection paths, and is especially suspicious because the declared purpose does not justify local user database operations.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, none of which are necessary for detecting turtle pneumonia symptoms from enclosure video. In this context, collecting and locally storing token material is dangerous because it expands privacy and credential exposure risk far beyond the skill’s stated veterinary-analysis purpose.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility file contains broad identity management, token handling, local user persistence, and authenticated network request logic that is unrelated to turtle pneumonia video analysis. That mismatch materially increases risk because the skill can silently act as a general account-aware API client, expanding data access and transmission far beyond the stated diagnostic purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code reads an identity value from a local credential-like file, looks up or creates local users, and can auto-register/login against an external endpoint to obtain tokens. For a camera-based animal symptom detection skill, silent identity resolution and account provisioning are unjustified and dangerous because they can bind workspace identities to remote services without informed user action.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill says uploaded attachments and media files are automatically saved locally, but it does not clearly warn the user at the point of collection that local persistence occurs. Saving videos of animals/enclosures can expose sensitive environmental or ownership data and increases retention and breach risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill mandates direct cloud API retrieval for history reports but does not clearly disclose to users that report-related data will be fetched from a remote service. That lack of transparency can result in unexpected data sharing and weakens informed consent and privacy expectations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
`OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` performs hidden identity resolution while the corresponding CLI parameter is suppressed from help output. Concealing identity-related behavior from the user undermines transparency and informed consent, and can facilitate unnoticed account correlation or access to user-linked history data.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code reads the full local file and transmits it to an external analysis service, but there is no visible notice, consent flow, or disclosure in this skill code. While file upload is functionally necessary for analysis, the absence of transparency creates a privacy risk because users may not realize local media is being sent off-device.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
User-supplied remote video URLs are forwarded directly to the analysis service without any visible warning or confirmation. This can expose private URLs, embedded credentials, or internal resource locations to the backend service, creating privacy and data-handling concerns.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads a sensitive identity from data/smyx-api-key.txt with no user-facing notice or validation of whether that file should be used by this diagnostic skill. In this context, covertly consuming local credential material is risky because it can repurpose workspace identity for unrelated remote actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The request helper injects usernames, access tokens, API keys, and authorization tokens into outbound HTTP requests without any visible user-facing disclosure in this file. In a turtle health analysis skill, transmitting identity and authentication material is especially suspicious because the stated function does not require broad authenticated platform interactions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2