Security audit
Security checks for vulnerabilities and agentic risk
This pet-video analysis skill needs review because account sharing, credential storage, and ignored execution controls could expose private footage or reports.
Before using private footage or a shared agent, require fixes for caller isolation and the ignored export-only flag. Confirm where videos are stored, how to delete them, how login tokens are protected, and whether service charges apply. The evidence supports review rather than a malicious verdict.
scripts/smyx_vomiting_regurgitation_detection_analysis.pyDefault CLI workflow ignores the upstream sender identity and reuses a shared account
In the described shared-Agent deployment, one caller can receive another caller's analysis records and report links. Analysis submissions are also associated with the shared fallback account.
The supplied chunk is primarily user-account database infrastructure, not video analysis or pet-health event recording. Database storage could support the declared purpose, but the concrete model and specialized operations concern user identities and tokens rather than pets, vomiting events, or vomitus characteristics. No video ingestion, action recognition, vomitus detection, or event-frequency tracking appears in this chunk. The code shows local storage capabilities, not token harvesting or network exfiltration. This assessment is limited to the supplied chunk; other skill components may implement the advertised detection.
The supplied chunk does not implement the declared pet-health detection purpose. Its only substantive method is an incomplete chat helper; it does not actually invoke an agent or analyze video. This is a functional mismatch, not evidence of malicious behavior or undeclared command execution. Imported base classes and services are not supplied, so their behavior cannot be assessed.
General formatting, polling, and filesystem helpers could reasonably support the declared skill. However, this chunk also implements an undeclared account-registration, credential-management, and billing integration involving local identity resources and remote services. These are substantive behaviors not represented by the pet-monitoring description. The supplied chunk contains no video processing, vomiting detection, vomitus classification, or event recording; those features may exist elsewhere, but they are not demonstrated here. The payment instructions are returned text, not evidence that this code installs another skill.
The supplied chunk implements a generic API client rather than the described video-analysis capability. It contains no camera processing, action recognition, vomitus detection, or event-analysis logic. HTTP helpers could support a larger monitoring system, but this chunk does not establish that connection, particularly for user lookup. This assessment is limited to the supplied code; it does not establish malicious activity or rule out relevant functionality elsewhere.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-vomiting-regurgitation-detection-analysis"
description: "AI-powered pet vomiting and regurgitation detection from indoor fixed-camera video. Identifies rhythmic abdominal contractions, head-forward extension, and mouth opening actions, plus detects vomitus on the floor (food, hairball, bile). Records event time, frequency, and vomitus characteristics for early digestive issue discovery. Scenarios: daily home health monitoring, multi-pet households, senior pet care, animal hospital inpatient observation. | 通过室内固定摄像头分析宠物活动区域的连续视频，利用动作识别技术检测宠物的呕吐或反流行为（
The helper accepts arbitrary absolute HTTP or HTTPS URLs and automatically adds service tokens, the API key, and the current user identity. A caller able to influence the destination can therefore send credentials to an attacker-controlled host, while HTTP also permits unencrypted transmission.
Without declared permissions the skill's intent is opaque and cannot be validated.
The default trigger treats any pet-area video submitted for analysis as authorization for this particular workflow, even when the user intended a different analysis. Because the workflow uses remote processing, this overbroad trigger can cause unintended processing and disclosure of private indoor footage.
Although the document mentions APIs and cloud history, the local-file workflow does not clearly state that the actual video contents leave the device or require informed authorization for that transfer. Indoor camera footage can expose household members, interiors, and routines, making this omission materially more sensitive than ordinary remote text processing.
The parser accepts --export-env-only and promises not to analyze, but the parsed flag is never checked. When input or --list is supplied, identity initialization and the normal remote workflow still run, potentially transmitting private footage or accessing account data despite the user's explicit non-execution selection.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The export-only flag is declared but never consulted, so providing it with a valid input still reaches the normal analysis call. This violates an explicit no-analysis expectation and can trigger unintended remote processing of sensitive indoor video; identity resolution also runs before any such guard.
The user model supports storing authentication tokens alongside personal data in an ordinary SQLite database, without visible encryption or restrictive file-permission handling. If populated, these credentials can be exposed through workspace access or backups; this source alone does not prove that credentials are actually collected.
The docstring at L26 and L33–L34 promises subprocess-based agent execution and an analysis result or session ID, but command execution is commented out. Instead, L68 creates an empty dictionary and L70 accesses its nonexistent stderr attribute; the exception is caught at L81–L82, causing every call to return None without performing analysis.
The generically named open helper always uses mode 'w', which immediately erases an existing file's contents. There is no docstring, explanatory comment, confirmation, or operation-specific log disclosing this destructive behavior; exception tracing does not disclose successful truncation.
An ordinary request can trigger remote registration using silent=1 and register=1, then persist returned authentication tokens without a separate consent step. This introduces undisclosed identity transmission and credential retention beyond the declared pet-video monitoring functionality.
The generic HTTP operation has hidden account-creation and credential-persistence side effects when authentication is missing. This duplicates the SDI-1 issue and can create remote identity records and retain reusable tokens without an explicit user decision.
This POST silently transmits the selected identity as both openId and mobile to the configured registration service. The identity-selection logic prioritizes API_SECRET_KEY, so a configured API secret can also be copied into account-profile fields, increasing exposure through service-side records and logs.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is absent, without a log, confirmation, docstring, or explanatory comment disclosing this side effect. BaseEnum.init_subclass invokes this loader during class definition (L053 and L058), so importing the module can modify the filesystem without an explicit save request.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
elif isinstance(cur, dict):
cur = cur.get(part, default)
else:
cur = getattr(cur, part)
return cur
except Exception:
return default