Back to skill

Security audit

Fish Aquatic Pet Health Diagnosis Analysis Tool | 鱼类水族宠物健康诊断分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches aquarium video analysis, but it silently manages account identity, stores tokens locally, and has inconsistent history-query instructions that deserve user review before installation.

Review this before installing if you are comfortable sending aquarium photos/videos and account-linked metadata to the publisher's cloud APIs. Treat generated reports and history as cloud/account-scoped data, and avoid using sensitive videos unless you accept the local SQLite token storage and silent identity handling shown in the artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill describes capabilities to read/write local files, invoke shell commands, access environment-linked identity handling, and call remote APIs, yet no explicit permissions are declared. This creates a transparency and policy-bypass risk because reviewers or runtime controls may underestimate the skill’s effective privileges and data-handling behavior.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documentation adds a cloud history-report lookup function beyond the manifest’s stated analysis behavior, expanding the skill from processing provided media to retrieving prior cloud-linked data. Scope expansion like this is dangerous because it can cause unintended access to user-associated records that operators and users did not expect from the declared skill purpose.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The skill instructs the agent to run an unrelated autism_analysis script for aquarium report history, which is a strong cross-skill inconsistency and could route data into the wrong code path or backend. This is dangerous because it may expose unrelated user data, invoke the wrong service, or enable accidental cross-domain data access under misleading instructions.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The `show_analyze_list` function exposes a capability to enumerate prior analysis records for a user, which exceeds the declared purpose of analyzing a supplied aquatic-pet video. This creates an unnecessary data-access surface and could disclose historical usage or report metadata tied to a user identity if invoked without strong authorization checks.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code resolves an internal `open_id` even though the core skill purpose is video health analysis, and then uses that identity for non-analysis operations such as listing prior records. Binding hidden internal identity resolution to this skill increases the chance of unintended user tracking or cross-user data access if identity handling is confused or abused.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script includes a history-listing path (`--list` via `show_analyze_list`) that exposes account-scoped prior analysis data, even though the skill description presents the capability as single-video health diagnosis. This expands data access beyond the user-visible purpose and can enable unintended retrieval of prior submissions or reports, which is a privacy and scope-control issue.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code resolves and uses `open_id`/current user identity to fetch account-scoped history, but that identity-linked access is not necessary for analyzing a submitted aquatic-pet video as described. Tying hidden identity resolution to a diagnosis skill increases privacy risk and broadens the blast radius if identity handling or authorization is weak, because historical user data may be exposed or queried without clear user expectation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This service exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the stated aquarium-analysis purpose. In a skill that should only process aquatic pet health videos, these helpers expand the attack surface and could be reused by other code paths to make unintended requests, access unrelated backends, or perform unauthorized state-changing operations.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The file defines a generic user database with identity fields and token storage even though the skill is described as aquarium video health analysis. This scope mismatch increases suspicion because it expands data collection beyond the stated purpose, creating unnecessary privacy and credential-handling risk if the skill stores user accounts or tokens without a clear functional need.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The User model stores token and open_token values directly in a local SQLite database, alongside identifying information such as username, realname, and email. Storing authentication-like secrets locally without evidence of encryption, rotation, or purpose limitation creates a concrete credential exposure risk if the database file is accessed by other skills, processes, or an attacker on the host.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill includes workspace discovery and automatic creation of agent data/skills directories that are unrelated to aquarium video diagnosis. In the context of a narrowly scoped pet-health analysis skill, this expands the skill's operational reach into the local agent environment and creates filesystem footholds that could be abused for persistence, cross-skill interference, or unauthorized data access.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code reads identity material from a local file/database and silently auto-creates persistent user identifiers when none exist. That behavior exceeds the declared purpose of analyzing aquatic pet videos and can cause hidden identity assignment, account creation, and tracking without informed user consent.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The HTTP helper silently bootstraps/logs in accounts, caches tokens, retries authorization, and persists credentials as part of ordinary request handling. For a video-analysis skill, hidden account lifecycle management materially increases risk because users may trigger remote account actions and credential storage without understanding that authentication and persistence are happening.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The history-report trigger phrases are broad enough that normal conversation about reports could automatically invoke cloud retrieval behavior. In this skill context, that increases the chance of unintentional access to stored health reports tied to an internal identity without a deliberate, clearly confirmed user action.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill states that uploaded files are automatically saved locally, but it does not clearly warn users about local persistence, retention, or cleanup. Because the skill handles potentially sensitive user media, silent local storage increases privacy and data exposure risk if files remain on disk or are accessible to other processes.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
When given a local path, the skill reads the entire file and uploads it to a server-side analysis API without any user-facing notice, confirmation, or inline consent mechanism in this code path. Because local videos may contain sensitive visual data or embedded metadata, silent transmission to a remote service creates a real privacy and data-handling risk, especially if users assume analysis is local.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The function silently reads an identity value from data/smyx-api-key.txt and treats it as the current internal identity. In this skill context, using a local API-key-related file as an implicit identity source without user notice creates opaque identity coupling and risks misuse of credentials or account context across unrelated operations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This request path transmits usernames/open IDs, tenant metadata, skill platform identifiers, and authentication headers to remote services without any user-facing disclosure in the code path. In a pet-health analysis skill, that creates a data-minimization and transparency problem because media analysis unexpectedly also sends account-linked metadata and tokens off-box.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2