Body Size/Weight Estimation | 畜禽体长/体重估测

• Outcome: Review
• Latest audit: Aug 26, 2026 · 8:25 AM UTC
• Version: 1.0.10

Overview

The skill’s livestock analysis purpose is clear, but it silently manages account identity, stores tokens locally, and sends identity-linked requests to configured services, so it needs Review before installation.

Review this before installing. Expect livestock media, supplied URLs, report queries, and identity-linked metadata to be sent to the configured service. Install only if you trust the publisher, accept silent account creation/login, local token storage, and cloud report history tied to an automatically selected identity.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to use shell execution, network access, local file handling, and implicit identity/state management, yet no explicit permissions or trust boundaries are declared in the manifest. This creates a confused-deputy risk where a reviewer or runtime may underestimate the skill's real capabilities, especially because it can fetch remote URLs, write local files, and call cloud APIs.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill includes functionality to retrieve historical analysis records by open_id, which is outside the stated purpose of estimating body size/weight from provided media. Even though this wrapper passes the current open_id into the listing call, exposing history retrieval increases the data-access surface and may enable unauthorized access or privacy leakage if identity resolution or downstream authorization is weak.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code silently initializes an internal user identity and uses it to expose analysis history via a hidden --open-id parameter and current-user resolution, without this being part of the stated skill purpose. Hidden identity-linked data access is risky because it can surprise users, bypass informed consent, and become an authorization flaw if callers can influence the resolved identity.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The script exposes a record-listing function via the hidden/internal `--list` and `--open-id` flow that is not aligned with the declared body-size/weight estimation purpose. This creates an unnecessary data-access surface that could let users enumerate prior analysis records tied to an `open_id`, potentially exposing metadata or historical results beyond the expected scope of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file exposes broad CRUD-style helpers and generic HTTP wrappers that can send arbitrary requests to caller-supplied URLs, which is substantially broader than a livestock body-size/weight estimation skill needs. In an agent context, this unnecessary capability increases the attack surface for data exfiltration, unauthorized service interaction, or repurposing the skill as a network pivot if higher-level inputs are attacker-controlled.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The http_post/http_put/http_get/http_delete methods provide arbitrary outbound network access using a caller-provided URL with no visible restriction or allowlist. For a skill whose declared purpose is local video/frame analysis for livestock estimation, this capability is unjustified and makes the skill more dangerous because it could be abused to contact attacker-chosen endpoints, exfiltrate data, or access internal services via SSRF-like behavior depending on the runtime environment.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: This module provides broad local database and user-record CRUD functionality, including create/update/delete operations for identities, inside a skill whose declared purpose is livestock body-size/weight estimation. That capability mismatch increases the attack surface and creates an unjustified place to store and mutate user-related state, which could be abused by other skill components to persist unexpected data or manipulate accounts.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The User model persists sensitive identity and authentication-related fields such as token and open_token without any demonstrated need for the livestock-estimation workflow. Unnecessary token storage expands the blast radius of local compromise, risks credential leakage, and is especially suspicious given the mismatch between the skill's stated purpose and the implemented account persistence features.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This utility code performs automatic remote account provisioning and authentication token acquisition that is unrelated to the stated livestock estimation function. It can silently create or log into accounts, persist tokens locally, and couple use of the skill to an external service identity, expanding the trust boundary and enabling undisclosed data transmission and account activity.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code derives agent identity and workspace context from environment variables, file paths, and local files, then uses that information to select credentials and identity values. In a multi-agent or shared workspace environment, this increases the risk of cross-context identity confusion, unintended credential reuse, and silent use of local identifiers without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The generic HTTP helper injects tenant, platform, skill hub, and user identifiers into outbound requests and includes billing-related handling unrelated to the advertised estimation task. This broad hidden behavior makes all consumers of the utility transmit additional metadata by default, increasing privacy and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When debug mode is enabled, urllib3/http.client logging is turned on globally, which can expose request and response contents during network activity. Even though some local prints redact long values, lower-level debug logging may still emit sensitive headers, tokens, or payload data into logs without user-facing warning.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The utility silently reads an identity value from data/smyx-api-key.txt and uses it as an internal open-id source. For a body-size estimation skill, hidden consumption of local identity material is unexpected and can lead to undisclosed account linkage or impersonation of a locally stored identity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper sends automatic login or registration requests to a remote endpoint with openId/mobile fields, without an explicit user-facing disclosure or authorization step. This can create external accounts and transmit identifiers unexpectedly, which is especially concerning because the skill's stated purpose does not require remote identity provisioning.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The request wrapper automatically attaches pnaUserName, tenantCode, skill hub, platform, and authentication headers to outbound requests. This creates undisclosed metadata transmission across all API calls and may leak organizational or user context to remote services beyond what is necessary for estimation processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: This code transmits registration/login data to an external service via requests.post, including identifiers used as openId and mobile. The external transmission itself is not inherently malicious, but in this skill context it is unexpected, undisclosed, and tied to automatic account provisioning, making it a genuine privacy and security concern.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 估测结果仅供育肥进度参考，本技能不提供饲喂建议或出栏建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 88% confidence
• Finding: The hidden-instructions indicator suggests the document may contain invisible or non-obvious control text that can alter agent behavior without clear reviewer visibility. In this skill, that risk is amplified because the surrounding instructions govern tool use, network/API access, report generation, and restrictions on how the agent should obtain data.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-body-size-weight-estimation-analysis"
description: "Estimates livestock body length and body weight from side-view videos or frames, tracking fattening progress in a contactless manner. | 通过视频视觉估测体长、体重，追踪育肥进度。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 83% confidence
• Finding: The manifest contains metadata-poisoning indicators, and the skill embeds operational directives in descriptive/manifest-style content that can influence tool selection and execution semantics. Because the skill directs shell invocation, cloud API querying, automatic local file saving, and hidden identity handling, misleading metadata increases the chance an agent will over-trust or mis-handle powerful actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2