Security audit

petkit-monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill’s monitoring purpose is coherent, but it ships a live-looking PETKIT account password and handles user passwords in unsafe plaintext ways.

Review this skill before installing. Do not use it with the bundled config.json; rotate that PETKIT password if it is real, remove the bundled credentials, and prefer a secure credential store or interactive password prompt instead of command-line passwords and plaintext config files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: config.json:1
Finding: Plaintext PETKIT Account Credentials Included in the Project
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: petkit_monitor.py:172
Finding: Password Exposed Through Command-Line Arguments and Insecure Plaintext Storage
Content: View full analysis
3: config['username'] = sys.argv[2] config['password'] = sys.argv[3] save_config(config) print(f"✅ 配置已保存: {config['username']}") ``` ### Technical Analysis The configuration command requires the user to provide the account password as a command-line argument. Command-line secrets can be exposed through shell history, terminal logging, process inspection, diagnostic tools, job-management systems, and command auditing. The password is subsequently written as plaintext JSON. The application does not explicitly enforce owner-only permissions; access is determined by the process umask and any existing file permissions. In an environment with permissive defaults, other local users or processes may be able to read the credentials. The file is also written directly rather than through an atomic, permission-controlled creation procedure. Although no concurrent attack is demonstrated in the reviewed code, the current approach provides no explicit confidentiality guarantees. ### Attack Path 1. A user runs: `petkit-monitor.py --configure `. 2. A local attacker reads the command from shell history, process metadata, terminal logs, or process-monitoring tools. 3. Alternatively, the attacker locates `config.json` and reads it if filesystem permissions allow access. 4. The attacker recovers the PETKIT password. 5. The attacker authenticates to the PETKIT account and obtains the privileges associated with that account. ### Impact Assessment An attacker with local observation or file-read access ...[truncated 412 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: petkit_monitor.py:10
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill requires sensitive credentials and the analyzer detected file_write capability, yet the manifest does not declare any tool scope or permissions boundary. That mismatch is dangerous because it hides the skill's effective capabilities from reviewers and users, increasing the risk that credentials, tokens, or device data could be written to local files without explicit authorization or review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and all user-facing instructions are written only in Chinese, with no indication that other languages are supported or that Chinese is a required locale. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a monitoring skill for retrieving feeder, litter box, fountain, and purifier status. In addition to status retrieval, the code writes user credentials to a local config file and exposes a --configure flow to store them, which is behavior beyond pure monitoring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code creates a client with username and password and then logs in to the PetKit service, which necessarily sends sensitive credentials over the network. There is no visible warning, prompt, or explanatory comment telling the user that their account data will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill stores the PetKit username and password in plaintext in a local config.json file without warning, encryption, or restricted handling. If the local filesystem is accessed by another user, process, backup system, or malware, the account credentials can be recovered and reused against the user's PetKit account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-facing strings, help text, and output formatting are all hard-coded in Chinese, which imposes a specific language on users. The file does not offer any language selection, opt-in, or documented justification for a Chinese-only experience.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The stated purpose is to get device status, but the script changes petkitaio.constants.FEEDER_LIST at import time to alter library behavior. This is not just fetching status; it extends runtime support by patching upstream constants, which goes beyond the narrow monitoring description.
Content: No source excerpt is available for this finding.