Security audit

宠物情绪识别

Security checks for vulnerabilities and agentic risk

Overview

This pet-photo analysis skill is purpose-aligned overall, but it has a real credential-handling flaw and unsafe generated-report behavior that users should review before installing.

Review before installing. Use a dedicated DashScope key, avoid running it in an environment with unrelated OPENAI_API_KEY values, and only analyze photos you are comfortable uploading to DashScope. Treat generated HTML reports as untrusted until the template escaping issue is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pet_emotion.py:43
Finding: Cross-Provider API Key Disclosure to DashScope
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/report_template.html:262
Finding: Stored HTML and JavaScript Injection in Generated Reports
Content: View full analysis
// --- Data from Python --- const result = { species: "{{SPECIES}}", emotion: "{{EMOTION}}", confidence: parseFloat("{{CONFI ...[truncated 3656 chars]
Remediation: View remediation
{{SAFE_RESULT_JSON}} ``` 4. When embedding JSON in HTML, escape characters that can terminate the element, especially `<`, for example by replacing it with `\u003c`. 5. Parse the data at runtime: ```javascript const result = JSON.parse( document.getElementById('report-data').textContent ); ``` 6. Replace all uses of `innerHTML` for model-generated content with DOM construction and `textContent`: ```javascript const value = document.createElement('div'); value.className = 'value'; value.textContent = card.value; ``` 7. Validate that all response fields have expected scalar types and enforce strict maximum lengths before report generation. 8. Apply defense in depth with a restrictive Content Security Policy. Prefer a locally bundled Chart.js asset so that the policy does not require broad third-party script access. 9. Remove inline event handlers and inline scripts where practical, or use CSP nonces or hashes if inline execution remains necessary. 10. Apply the same corrections to both `assets/report_template.html` and the fallback template in `get_default_template()`. 11. Add regression tests using payloads containing: - Quotation marks and backslashes. - `` sequences. - Template-literal interpolation syntax. - HTML elements with event handlers. - Unicode and malformed model responses. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and flow do not clearly warn the user that uploaded pet photos are transmitted to DashScope, an external service, for multimodal analysis. This creates a privacy and consent issue because users may believe processing is local while sensitive images are actually sent off-device.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The script reads secrets from environment variables and local config files, but this capability is not reflected in the declared permissions. Hidden secret-access behavior increases the blast radius of a seemingly simple image-analysis skill and can violate least-privilege expectations for users and platforms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad natural-language phrases such as 'pet emotion', '看看我家猫', '看看我家狗', and '帮我看看宠物' that could match ordinary conversation rather than an explicit command. In an agent environment, this can cause unintended invocation of a skill that processes user images and calls an external multimodal API, increasing privacy and consent risk even if the skill's purpose is otherwise harmless.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list includes broad everyday phrases like '看看我家猫/狗' and '帮我看看宠物', which can activate on casual photo sharing rather than a clear request for analysis. That increases the chance the agent processes and transmits user pet images to the skill without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation scenarios say the skill should run when a user shares a pet photo and 'wants to understand mood', which is ambiguous and may over-infer consent from general image sharing. In this skill's context, that is more dangerous because the image is later sent to a third-party API for analysis.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This finding identifies the same outbound request that sends user-provided image data to a third-party API endpoint. While the transmission supports the advertised feature, it is still a true privacy-sensitive behavior and should be treated as such in a skill that may activate on broad triggers.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
"temperature": 0.1 } resp = requests.post( "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json=payload, timeout=30

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This finding identifies the same outbound request that sends user-provided image data to a third-party API endpoint. While the transmission supports the advertised feature, it is still a true privacy-sensitive behavior and should be treated as such in a skill that may activate on broad triggers.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
"temperature": 0.1 } resp = requests.post( "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json=payload, timeout=30

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The HTML root sets lang="zh-CN", which hard-codes a specific language/locale for the skill output. Under the policy, forcing a locale without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template loads Chart.js from a third-party CDN at runtime, which introduces a supply-chain and privacy risk: report viewers will make network requests to an external domain, and a compromised or swapped CDN asset could execute arbitrary JavaScript in the report context. This is more concerning because the report also injects multiple template variables directly into the page, so any malicious script would have access to rendered pet analysis data and the surrounding DOM.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Multiple user-visible strings such as AI 情绪识别分析, 置信度, and 情绪分布雷达图 are fixed in Chinese, indicating the skill output is constrained to one language. The file does not show any mechanism for selecting language or notifying users of a locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script uses Chinese-only emotion labels and presents prompts, errors, summaries, and the generated HTML report in Chinese, with no option to select another language. This enforces a specific locale in natural-language outputs without user opt-in.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/pet_emotion.py (reported line 33)May include surrounding context.
python
} DASHSCOPE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions" OPENAI_URL = "https://api.openai.com/v1/chat/completions" def find_api_key():

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill searches for API keys in multiple locations, including OPENAI_API_KEY and local config files unrelated to the stated pet-emotion purpose. This broad credential harvesting behavior can unintentionally consume unrelated secrets and makes the skill more dangerous if reused, modified, or compromised.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The CLI exposes an 'openai' option, but execution always sends data to DashScope. This mismatch can mislead users about where their image and credentials are going, undermining informed consent and creating an unexpected third-party data transfer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script base64-encodes the user's pet photo and transmits it to an external multimodal API without an explicit privacy warning or consent step. Images may contain sensitive metadata or household context, so silent upload to a third party creates a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The visible skill title, tagline, and primary usage description are presented in Chinese, and the trigger phrases are predominantly Chinese, with no statement that users may choose another language. This can conflict with a language/locale policy requiring user choice unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire markdown file is written in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:18

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:75