Body Size/Weight Estimation | 畜禽体长/体重估测

• Outcome: Review
• Latest audit: Oct 11, 2026 · 11:27 PM UTC
• Version: 1.0.13

Overview

The skill is coherent as a cloud livestock-measurement tool, but it silently creates/reuses an identity and stores service tokens for cloud history access.

Review this before installing if farm media, account history, or tenant identity is sensitive. The skill sends media/URLs and report-history requests to an external service, may create or reuse a cloud identity automatically, and persists service tokens locally in the workspace data database.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, local file and directory creation, environment/context detection, generated user identities, and token/account handling are powerful capabilities not implied by the public description. In combination, they create meaningful risk of privacy leakage, unauthorized persistence, and abuse of account-scoped resources, especially since the skill directs automatic identity reuse and cloud history access.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-body-size-weight-estimation-analysis"
description: "Estimates livestock body length and body weight from side-view videos or frames, tracking fattening progress in a contactless manner. | 通过视频视觉估测体长、体重，追踪育肥进度。"
version: "1.0.15"
license: "MIT-0"
---

# 📏 Livestock Body Size & Weight Estimation | 畜禽体长/体重估测

> 通过视频视觉估测体长、体重，追踪育肥进度。
>
> **无接触育肥监测中枢** · 畜禽侧视图像/视频智能分析 · 体长/体高/胸围识别 · 参照物尺寸换算 · 体重与育肥阶段估测 · 历史报告云端查询

---

## �

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The User model stores identity and authentication-related material including username, realname, email, token, and open_token without any clear connection to the livestock-analysis function. Unnecessary collection and local persistence of token data materially increases the risk of credential leakage, account compromise, and privacy violations if the workspace or database is accessed by other components.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility code creates and persists open-id style identities unrelated to livestock measurement, including reading identity material from workspace files and creating local default users. In the context of a body-size/weight estimation skill, hidden identity bootstrapping expands the skill's privilege surface and enables unexpected account linkage or impersonation behavior that users would not reasonably expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The HTTP client automatically manages tokens, performs login/registration flows, injects identity headers, retries authorization, and persists returned credentials. For a livestock analysis skill, this is over-privileged behavior that can silently transmit user identifiers and establish long-lived remote access without a clear functional need tied to video/frame measurement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The _get_or_create_user flow silently posts openId/mobile values to a remote /sys/phoneLogin endpoint with register=1 and silent=1, effectively auto-registering or logging in users without informed consent. This can leak identifiers off-host and create remote accounts behind the scenes, which is especially suspicious and unjustified for a body-measurement skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and instructs use of shell, network, local file read/write, and environment-derived identity handling, but the manifest declares no explicit tool/permission scope. That creates an implicit broad-trust model where an agent may execute high-risk actions without a least-privilege contract, making review, sandboxing, and user consent harder. In this skill, that matters because it combines shell execution, remote API access, and local persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The auto-trigger phrases for history lookup are broad enough that normal conversation about reports or progress could cause unsolicited cloud queries. In a skill that links requests to an internal identity and historical records, this can expose private report metadata or perform actions the user did not clearly intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states uploaded media will be automatically saved locally, but does not present a clear user-facing retention, location, or deletion policy. For image/video content tied to farm operations and account-linked reports, silent persistence increases privacy, compliance, and accidental exposure risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script exposes a history-listing function via --list that is not part of the stated skill purpose of estimating body size/weight from media. Because it operates on an open_id-scoped history and is reachable from the same CLI, it expands the attack surface into data retrieval and may disclose prior analysis records beyond the user’s expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The CLI accepts remote URLs and forwards them for analysis without clearly warning users that external content may be fetched or transmitted to backend services. In a media-analysis skill, this creates privacy and trust issues because users may unintentionally cause the tool to access third-party resources or upload sensitive URLs/media to remote infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hidden --open-id parameter combined with OpenIdUtil.resolve_current_open_id(...) and the --list flow can enable access to analysis history without clear user-facing disclosure. Hidden identity-affecting parameters are especially risky because they obscure security-sensitive behavior and can permit enumeration or retrieval of another user’s records if server-side authorization is weak.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code reads the entire local file into memory and passes it to self.analysis, which implies transmitting user-provided file data to an external analysis service. In this file, there is no confirmation prompt, print/log disclosure, or comment warning users that local file contents will be uploaded or transmitted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script accepts a local file path or remote video URL and passes it to skill.get_output_analysis(...), which the surrounding code and comments indicate invokes an external analysis API. There is no explicit user-facing notice, confirmation, or consent mechanism explaining that input data may be transmitted off-system, which creates a real privacy and data-handling risk, especially for potentially sensitive livestock/farm video data or internal URLs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as estimating livestock body length and weight from videos or frames, but this module provides generic network helpers for listing, adding, editing, deleting, and arbitrary HTTP GET/POST/PUT/DELETE requests to caller-supplied URLs. Those broad remote-service capabilities are not inherently required by the stated computer-vision estimation purpose and materially extend what the skill can do.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2