jf-open-pro-ai-pet-care

• Outcome: Review
• Latest audit: Jul 30, 2026 · 1:47 PM UTC
• Version: 1.0.1

Overview

This is a coherent JF Tech pet-care API skill, but it needs Review because it handles powerful credentials unsafely and can immediately change or delete cloud pet-care records and alert settings.

Install only if you are comfortable giving this skill JF Tech app credentials and token-backed authority over pet-care API data and settings. Prefer environment variables or a secret manager over TOOLS.md or command-line flags, avoid committing credentials, and manually confirm any delete, service switch, or alert-disabling command before running it. The scripts also appear to have movecard parameter bugs that may affect reliability.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents network access and shell-based script execution but does not declare permissions. Undeclared capabilities weaken user oversight and security review because consumers may not realize the skill can make external API calls and invoke local commands. In a developer-facing skill, this is more concerning because it is explicitly designed to run scripts against live services.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script’s implemented purpose materially diverges from the skill’s stated pet-care monitoring/reporting/video-archive functionality and instead performs remote pet profile CRUD against a backend API. Capability mismatch is dangerous because users or reviewers may grant trust and credentials for a benign monitoring skill while the code can create or alter persistent records they did not expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code exposes delete and update operations for remote pet records, which are destructive/state-changing actions not justified by the described babysitting/reporting use case. In this context, such hidden mutation capability increases the risk of unauthorized record tampering or deletion if the skill is invoked with valid credentials.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The documentation tells users to place sensitive credentials, including app secrets and JWT authorization tokens, into TOOLS.md on the local machine without emphasizing secrecy controls. If TOOLS.md is synced, committed, shared, or readable by other local users or tools, those credentials can be stolen and used to access the JF Tech account, devices, and APIs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The examples pass secrets and JWT tokens directly on the command line. Command-line arguments may be exposed through shell history, terminal logs, CI logs, crash reports, and process listings visible to other users on the same system, enabling credential theft.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The set-config path performs state-changing operations immediately once arguments are provided, with no confirmation prompt, dry-run, or explicit warning that remote notification behavior will be altered. In this pet-care context, disabling or weakening alerts could cause missed anomaly notifications and reduce safety monitoring for the pet or device.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The script performs a state-changing action immediately when called with valid credentials and --enable, with no confirmation prompt, dry-run mode, or explicit warning. In an agent/automation context, this increases the risk of accidental or unauthorized service disablement/enabling if the tool is invoked by mistake or through prompt-induced misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete path performs a destructive remote action immediately once arguments are provided, with no confirmation, dry-run, or safeguard. In a CLI handling persistent pet records, this raises the likelihood of accidental or scripted deletion, especially because the skill context does not justify destructive administration as a primary function.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Accepting secrets and bearer tokens via command-line arguments can expose them through shell history, process listings, job-control logs, and monitoring tools on multi-user systems. In this pet-care skill context, the credentials grant access to cloud pet telemetry and potentially associated device/user data, so leakage could enable unauthorized API access.

Static analysis

No suspicious patterns detected.