Fish Aquatic Pet Health Diagnosis Analysis Tool | 鱼类水族宠物健康诊断分析工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:01 AM UTC
• Version: 1.0.13

Overview

The skill is a real aquarium video analysis tool, but it silently links users to cloud accounts, stores tokens locally, and the active configuration can send media and credentials to plaintext development endpoints.

Install only after the publisher ships a production configuration using HTTPS, removes or tightly scopes the generic HTTP helpers, documents identity and token storage, and provides clear user control for uploads and history lookup. Treat any prior tokens or logs from this package as potentially exposed if it ran with the dev configuration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/config-dev.yaml:1
• Finding: Plaintext Transmission of Uploaded Media, Identity Data, and Authentication Credentials<![CDATA[ ## Vulnerability Details **File Locations**: - `skills/smyx_common/scripts/config.yaml:4-6,15` - `skills/smyx_common/scripts/config-dev.yaml:1-4` - `skills/smyx_analysis/scripts/skill.py:113-130` - `skills/smyx_common/scripts/util.py:610-612,646` **Vulnerability Type**: Sensitive data transmitted over an unencrypted network connection **Risk Level**: High ### Vulnerable Code `skills/smyx_common/scripts/config.yaml:4-6,15`: ```yaml base-url-health: https://lifeemergence.com/jeecg-boot-xzgz base-url-open-api: https://open.lifeemergence.com/smyx-open-api base-url-open-h5: http://livemonitor.lifeemergence.com env: dev ``` The active development configuration overrides those HTTPS endpoints. `skills/smyx_common/scripts/config-dev.yaml:1-4`: ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ``` `skills/smyx_analysis/scripts/skill.py:113-130`: ```python if (input_path.startswith("http://") or input_path.startswith("https://")): params.update({ "videoUrl": input_path }) else: _validate_file(input_path) # Automatically detect MIME type mime_type, _ = mimetypes.guess_type(input_path) if mime_type is None: mime_type = 'application/octet-stream' # Read file content with open(input_path, 'rb') as f: file_content = f.read() files = { 'file': (os.path.basename(input_path), file_content, mime_type) } ``` `skills/smyx_common/scripts/util.py:610-612,646`: ```python headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN) ``` ```python response = requests.request(method, url, *args, json=data, params=params, headers=headers, timeout=int(timeout), **argss) ``` ### Technical Analysis The distributed configuration e ...[truncated 2349 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `env: dev` from the release configuration and use HTTPS production endpoints by default. 2. Reject API base URLs that do not use HTTPS, except in an explicitly isolated test environment. 3. Do not distribute private development endpoints in production Skill packages. 4. Validate remote media URLs and reject plaintext HTTP unless the user explicitly accepts the risk in a controlled environment. 5. Keep TLS certificate verification enabled and do not introduce `verify=False`. 6. Restrict outbound requests to an allowlist of documented service domains. 7. Use short-lived, narrowly scoped tokens so interception has limited value. 8. Rotate credentials used while the plaintext configuration was active. 9. Add an automated release test that fails if any active service endpoint uses `http://`. 10. Update the privacy documentation so that it accurately reflects the implemented data flow and service destinations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/util.py:24
• Finding: Low-Level HTTP Debugging Can Expose Authenticated Requests and Uploaded Media<![CDATA[ ## Vulnerability Details **File Locations**: - `skills/smyx_common/scripts/config.yaml:15` - `skills/smyx_common/scripts/config-dev.yaml:6-7` - `skills/smyx_common/scripts/util.py:24-35` **Vulnerability Type**: Sensitive information exposure through verbose HTTP logging **Risk Level**: High ### Vulnerable Code `skills/smyx_common/scripts/config.yaml:15`: ```yaml env: dev ``` `skills/smyx_common/scripts/config-dev.yaml:6-7`: ```yaml ConstantEnum: is-debug: true ``` `skills/smyx_common/scripts/util.py:24-35`: ```python if ConstantEnum.is_debug(): import http.client # Enable debugging http.client.HTTPConnection.debuglevel = 1 # Configure logging import logging logging.basicConfig() logging.getLogger().setLevel(logging.DEBUG) requests_log = logging.getLogger("urllib3") requests_log.setLevel(logging.DEBUG) requests_log.propagate = True ``` ### Technical Analysis The active development environment sets `is-debug: true`. During module initialization, this enables Python's low-level `http.client` debugging and globally raises the root and `urllib3` logging levels to `DEBUG`. The code later makes authenticated requests containing access tokens, authorization tokens, internal identity values, request parameters, and multipart media uploads. Although the custom request log deliberately omits complete headers, that custom redaction does not control output produced independently by `http.client` or `urllib3`. Low-level HTTP diagnostics may therefore expose request lines, headers, payload metadata, or request bodies to standard output and application logs. In multipart requests, this can include sensitive file content or portions of the upload, depending on the runtime library behavior. Global logging configuration also affects unrelated HTTP traffic in the host process, potentially expanding disclosure beyond this Skill's requests. ### Attack Path 1. The Skill loads `config.yaml` and applies the active `dev ...[truncated 1182 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `is-debug: false` in every distributed or production configuration. 2. Remove `http.client.HTTPConnection.debuglevel = 1` from production-capable code. 3. Do not globally set the root logger to `DEBUG`. 4. Use a dedicated Skill logger with a conservative default level. 5. Implement explicit redaction for authorization headers, identity values, query parameters, and multipart bodies. 6. Never log uploaded media or complete API responses containing private report data. 7. Require a separate, explicit development-only switch before enabling diagnostics. 8. Add tests that capture log output and verify that token values and test media markers never appear. 9. Restrict access to historical logs and apply short retention periods. 10. Rotate credentials if prior logs may have captured authenticated traffic. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/dao.py:449
• Finding: Reusable Authentication Tokens Are Stored Unencrypted in a Workspace SQLite Database<![CDATA[ ## Vulnerability Details **File Locations**: - `skills/smyx_common/scripts/util.py:580-604` - `skills/smyx_common/scripts/dao.py:166-180` - `skills/smyx_common/scripts/dao.py:449-465` **Vulnerability Type**: Insecure local storage of authentication credentials **Risk Level**: Medium ### Vulnerable Code `skills/smyx_common/scripts/util.py:580-604`: ```python if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` `skills/smyx_common/scripts/dao.py:166-180`: ```python def __init__(self, db_path: str = None): """ Initialize DAO. :param db_path: SQLite database file path """ # Force storage in the shared workspace data directory if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) ``` `skills/smyx_common/scripts/dao.py:449-465`: ```python c ...[truncated 3195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store reusable credentials in an operating-system keyring or dedicated encrypted secret store rather than ordinary SQLite columns. 2. Prefer short-lived access tokens and secure refresh-token rotation. 3. Avoid persistent token storage if a session-scoped credential is sufficient. 4. If persistence is unavoidable, encrypt credentials with a key that is not stored beside the database. 5. Create the data directory and database with owner-only permissions, such as `0700` for the directory and `0600` for the file on POSIX systems. 6. Validate permissions before reading or writing the database and refuse insecure configurations. 7. Scope tokens only to aquarium analysis and report retrieval. 8. Revoke stored tokens during logout, user removal, or detected authorization failures. 9. Do not store unnecessary profile fields returned by the authentication service. 10. Document local credential persistence and provide users with a supported way to delete the stored identity and tokens. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Automatic user/open-id generation, local token lookup, filesystem/environment discovery, reading local API key material, and silent phoneLogin/register flows are highly sensitive behaviors for a skill described as pet-video analysis. This can create undisclosed identity linkage, credential exposure, and remote account actions without informed user understanding or granular review.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "aquarium-analysis"
description: "When a user provides a video URL or file of aquatic pets such as goldfish, koi, betta, shrimp, crab, etc. for analysis, this skill is triggered to perform aquatic pet health diagnosis analysis. Supports uploading local videos or online video URLs, calls server-side API for aquatic pet health examination, analyzes features such as scales, fins, body color, activity level, identifies potential diseases and outputs a pet health report. | 鱼类水族宠物健康诊断分析工具，当用户提供金鱼、锦鲤、斗鱼、虾、蟹等水族宠物的视频 URL 或文件需要分析�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises and operationalizes shell, filesystem, environment, and network-capable behavior but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution and makes it harder for reviewers and policy engines to restrict the skill to only the capabilities actually needed.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger condition is ambiguous and may cause the skill to auto-run whenever aquatic-pet media is mentioned for analysis, even when the user intended a different workflow. This mainly creates unauthorized or surprising execution risk rather than a direct exploit, but it becomes more concerning because the skill may contact remote services and associate data with an internal identity.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Overly broad trigger phrases for historical report lookup can activate the skill during ordinary conversation, causing unintended cloud queries or disclosure of report metadata. Because this skill claims automatic account association, accidental triggering is more dangerous than in a purely local or stateless tool.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The history-report instructions tell the agent to run an unrelated autism_analysis script, which is a strong sign of copy-paste error or instruction confusion. In an agent setting, invoking the wrong script can lead to unintended data access, wrong API calls, or disclosure of unrelated report history.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The analysis function sends either a local file path-derived input or a remote URL to a backend API, but the script does not clearly disclose to the user that their content will be transmitted off-box. For health-style media analysis, this creates a data-handling and privacy risk, especially if users assume processing is local or do not realize third-party services receive the media.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The file includes helper workflows for retrieving prior results and generating export URLs, which are outside the narrow manifest claim of returning a health report for the supplied video. This expands the skill's data access surface and may enable unintended disclosure of historical reports or direct-download links if these functions are reachable elsewhere in the skill ecosystem.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The CLI contains hidden identity-aware behavior and an analysis-history listing mode that go beyond the stated purpose of analyzing a user-provided aquarium video. Even if intended for convenience or internal use, silently resolving user identity and exposing prior analysis records can leak personal usage history or enable unauthorized access patterns if invoked by another component or user.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code initializes internal identity resolution without clear user notice, using current identity context behind the scenes. Hidden collection or use of identity context is a privacy and authorization concern because it can tie analyses to a user account or unlock account-scoped history access without transparent consent.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This skill returns fixed Chinese-language strings such as the report heading and export-link text, and similar hardcoded Chinese messages appear elsewhere in the file. That is a natural-language locale policy concern because the skill does not offer a user opt-in or language selection.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill reads arbitrary local file contents and uploads them to a server-side analysis API, but this code path contains no explicit disclosure, confirmation, or consent gate before transmission. Because the skill handles local files, users may unknowingly send sensitive media or metadata off-device, creating a privacy and data-governance risk even if the upload is expected by the feature design.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This service exposes broad generic HTTP and CRUD wrappers that can be used to contact arbitrary URLs and perform operations unrelated to aquatic pet video diagnosis. In a skill whose stated purpose is narrowly scoped to health analysis of uploaded videos, this unnecessary capability increases attack surface and could enable server-side request forgery or unintended access to internal or third-party services if callers can influence the URL or request arguments.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The add, edit, and delete helpers provide generic remote state-changing operations without any visible restriction to approved endpoints or business actions. Because the skill's manifest describes analysis of aquatic pet videos rather than administrative or arbitrary data modification, these methods create unjustified capability that could be abused to alter remote resources if exposed through higher-level code.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The http_post, http_put, http_get, and http_delete methods accept a caller-supplied URL and pass it directly to the request utility, enabling arbitrary outbound requests. In the context of a video-analysis skill, this is broader than necessary and is especially dangerous because it can facilitate SSRF, access to internal metadata/services, network pivoting, or exfiltration through attacker-chosen destinations.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a narrowly scoped aquatic pet health diagnosis skill, but this configuration embeds scene codes for many unrelated domains including human risk, infant monitoring, psychology, driving, plants, livestock, and workplace analysis. Even though this file is configuration-oriented, wiring the skill to a broad catalog of unrelated scene identifiers is not justified by the stated aquarium-analysis purpose and indicates the skill package carries cross-domain capability selection support.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2