Back to skill

Security audit

Pet Vomiting / Regurgitation Detection | 宠物呕吐/反流行为识别

Security checks across malware telemetry and agentic risk

Overview

This skill performs the advertised pet video analysis, but it also uploads sensitive indoor video data and automatically binds activity to a persistent local or cloud identity with limited user control.

Review before installing if you are uncomfortable with indoor pet videos being sent to external services, linked to an automatically managed identity, stored in report history, or associated with locally persisted tokens. Prefer installation only if you accept the cloud account/report model and can manage or delete stored identity/report data outside the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill manifest exposes capabilities to read/write files, invoke shell commands, access environment data, and perform network operations, yet it declares no explicit permissions or user-facing consent boundaries. That mismatch is dangerous because the skill handles indoor camera footage and can silently transmit data to external services or manipulate local state without a transparent permission model.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The documentation adds an automatic cloud history-report query feature that expands the skill from one-shot pet video analysis into remote report retrieval. This broadens data access and creates a secondary data flow involving historical records, which can expose prior sensitive monitoring results without a clearly scoped authorization or privacy notice.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill states that it will silently initialize identity, reuse a default local user, or create one if absent, all without user visibility. Hidden identity bootstrapping is dangerous because it can bind sensitive indoor surveillance data and medical-adjacent observations to an implicit account, causing unauthorized cross-session access, data mixing, or persistent tracking.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script exposes a history-listing capability via `--list` and `show_analyze_list(open_id)` that is outside the stated purpose of single video analysis. Because it is tied to an internally resolved identity and the `--open-id` / `--api-key` parameters are hidden from help output, users may be able to access prior analysis records without clear authorization boundaries or disclosure.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code initializes internal identity state with `OpenIdUtil.resolve_current_open_id(...)` even for a tool whose primary function is local or URL-based video analysis. This creates hidden coupling to user identity and can enable unexpected account-context actions such as retrieving or associating analysis data with an internal profile.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill accepts arbitrary http/https video URLs even though the stated use case is indoor fixed-camera monitoring. Allowing unrestricted remote URLs expands the trust boundary and can enable server-side fetching of attacker-controlled resources, potentially causing unexpected network access, privacy issues, or misuse of backend analysis infrastructure.

Context-Inappropriate Capability

Medium
Confidence
79% confidence
Finding
The generic http_post/http_put/http_get/http_delete methods accept caller-controlled URLs and forward requests without visible allowlisting or restriction. In a skill intended for specialized pet video analysis, this broad outbound network capability can be repurposed for unauthorized data transmission or access to unintended remote services if higher-level inputs are attacker-influenced.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file implements a generic user-account model and DAO, including username, realname, email, birthday, and token-related handling, which is unrelated to the declared pet vomiting/regurgitation video-analysis purpose. This scope mismatch increases privacy and supply-chain risk because the skill can persist and manage user identity data without clear user expectation or manifest disclosure.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The code creates and manages a local SQLite database with generic CRUD persistence, but the manifest describes only video-based pet health event detection and does not mention local storage. Undisclosed persistence is a security and privacy concern because it expands data retention and attack surface beyond user expectations, though local CRUD alone is not inherently malicious.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores personal identity fields and sensitive token/open_token values, which are not justified by a pet vomiting/regurgitation detection skill. Unnecessary credential and PII storage materially increases breach impact, especially because the code shows generic CRUD handling without visible encryption, secret management, or purpose limitation.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs remote account provisioning and login flows completely unrelated to pet vomiting/regurgitation video analysis, including creating or recovering user identities and attaching tokens to outbound requests. In the context of a narrowly scoped pet-health video skill, this is dangerous because it silently expands behavior into identity management and external service access, enabling undisclosed data transmission and unauthorized account actions.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
This code inspects workspace layout, reads OPENCLAW_WORKSPACE, derives agent roots, creates shared data directories, and resolves persistent open IDs from local files or local databases. For a pet video analysis skill, cross-agent workspace identity discovery and persistence are out of scope and increase the risk of covert tracking, identity reuse across agents, and unintended access to other workspace data.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default trigger activates whenever a user provides pet activity video for analysis, even if the user did not specifically request vomiting/regurgitation detection. Overbroad activation is risky because it can cause unexpected processing of private indoor footage and may send content to external analysis backends without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
83% confidence
Finding
Keyword activation includes broad terms such as digestive abnormality-related phrasing that may match unrelated pet-health or video-analysis requests. This can unintentionally invoke the skill and start processing sensitive footage or querying reports when the user did not intend to use this capability.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill processes local files and network URLs containing indoor camera footage but does not clearly warn users that the content may be uploaded to or processed by external/cloud services. This is dangerous because indoor pet-monitoring video can reveal household interiors, routines, occupants, and other sensitive details, creating privacy and compliance risks.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script performs hidden internal identity initialization and suppresses related CLI help (`--open-id` is not shown), reducing user awareness that account-linked behavior may occur. Hidden identity handling is dangerous because it undermines informed consent and can mask unauthorized access to or correlation with historical reports.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill reads the entire local file and sends it to the analysis service, but there is no visible user-facing notice, consent prompt, or data handling disclosure in this code path. Because videos from inside homes can contain sensitive personal or household information, silent transmission creates a meaningful privacy risk even if the service is functioning as intended.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
These generic HTTP helpers enable silent outbound requests with caller-supplied parameters and destinations, creating a reusable channel for transmitting skill data off-device. In the context of a pet-monitoring skill that may process sensitive household video-derived data, unrestricted network egress increases the risk of covert exfiltration or misuse if any upstream component is compromised or overly permissive.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The function reads a sensitive identity value from data/smyx-api-key.txt and treats it as an internal open ID without any user-facing notice, consent, or provenance checks. Even if local-only at first, silently ingesting identity material from disk is dangerous because it can bind the skill to an existing account or agent identity and later propagate that identity to remote services.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The HTTP login request sends identity fields such as openId, mobile, and source to a remote service without any user-facing disclosure. In a pet health monitoring skill, transmitting account-linked identifiers is contextually more dangerous because users would reasonably expect local video analysis, not hidden authentication or identity propagation.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB;建议时长 ≥ 30 秒 |
| 🔎 使用提醒 | 摄像头需固定且视角覆盖宠物活动区域及地面,移动/手持拍摄可能影响检测效果 |
| 🧑‍⚖️ 结果性质 | **识别结果仅供行为观察参考,不提供医疗诊断**;频繁呕吐或呕吐物带血建议立即就医 |
| 🔎 使用提醒 | 宠物可能做出类似呕吐的伸懒腰、咳嗽等动作,存在一定误检可能,建议结合呕吐物确认 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
Confidence
74% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-vomiting-regurgitation-detection-analysis"
description: "AI-powered pet vomiting and regurgitation detection from indoor fixed-camera video. Identifies rhythmic abdominal contractions, head-forward extension, and mouth opening actions, plus detects vomitus on the floor (food, hairball, bile). Records event time, frequency, and vomitus characteristics for early digestive issue discovery. Scenarios: daily home health monitoring, multi-pet households, senior pet care, animal hospital inpatient observation. | 通过室内固定摄像头分析宠物活动区域的连续视频,利用动作识别技术检测宠物的呕吐或反流行为(包括腹部节律性收缩、口部张合、头部前伸等典型动作),同时识别地面是否出现呕吐物(食物残渣、毛球、黄色胆汁等),记录发生时间、频次以及呕吐物特征。有助于主人及早发现宠物的消化系统问题,避免延误治疗。应用场景:宠物家庭日常健康监护、多宠家庭、老年宠物护理、宠物医院住院观察。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
71% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2