Back to skill

Security audit

Pet Cage Cleanliness Detection | 宠物寄养笼舍清洁度识别

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with remote cage-cleanliness analysis, but it silently manages account identity, stores tokens locally, and uploads media to cloud services.

Install only if you are comfortable with uploaded cage media and report queries being processed by the Life Emergence cloud service, and with the skill creating/reusing a local identity plus storing service tokens in the workspace. Avoid using it on unrelated or sensitive local files, and review/delete the workspace data database if you later revoke access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises no explicit permissions, yet the manifest instructs use of shell execution, network access, local file saving, and implicit environment-backed identity handling. This creates a transparency and consent gap: operators and users may invoke a skill with materially broader capabilities than expected, increasing the risk of data exposure or unintended side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrow image cleanliness analysis, but the described behavior includes account bootstrap, token acquisition, local persistence of identities, and cloud history retrieval. This mismatch is dangerous because it hides security-relevant data processing and authentication behavior behind an innocuous computer-vision use case, undermining informed consent and review.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill is described as a cage-cleanliness analysis tool, but this CLI also exposes a historical report listing function keyed by user identity. That expands the data-access surface beyond the stated purpose and may enable unauthorized enumeration or disclosure of prior analysis records if access control is weak or inherited implicitly from internal identity state.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code initializes and uses an internal user identity (open_id) even though that identity is not necessary for basic local/image URL cleanliness detection. Hidden identity binding can cause actions and data retrieval to occur in the context of a user account without transparent disclosure, creating privacy and authorization risks if the resolved identity is unintended or attacker-influenced.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill metadata describes a narrowly scoped fixed-camera cage-cleanliness image analysis tool, but the implementation accepts arbitrary local files and remote URLs for generic video analysis. This scope mismatch can mislead users and reviewers about what data the skill can ingest and where it may send that data, increasing the chance of unauthorized or privacy-sensitive uploads.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The implementation materially exceeds the stated scope of a fixed-camera cage cleanliness detector by acting as a generic video-analysis CLI for arbitrary local files and remote URLs. That mismatch is dangerous because operators may grant this skill trust, permissions, or deployment approval appropriate for a narrow kennel-monitoring tool while it can process unrelated media and interact with external content, increasing privacy, compliance, and misuse risk.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Allowing arbitrary remote video URLs introduces an unnecessary external-ingest path that is not supported by the fixed-camera use case. This can enable analysis of attacker-controlled content, accidental exfiltration of access patterns to third-party hosts, and broader misuse of the skill beyond the expected operational boundary.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The CLI advertises a safety-relevant flag that implies no analysis will be executed, but the flag is ignored. Users or automation may rely on this contract during testing or environment setup and inadvertently trigger real analysis or network-backed processing, causing unexpected data handling or charges.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This file exposes a broad, generic API wrapper for add/edit/delete/list and raw HTTP GET/POST/PUT/DELETE operations that are not scoped to the skill’s stated purpose of cage-cleanliness image analysis. In an agent/skill environment, this unnecessarily expands the skill’s capability surface and could be abused to interact with unintended internal or external services, enabling data exfiltration, unauthorized actions, or pivoting beyond the declared function.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The raw http_post/http_put/http_get/http_delete methods provide arbitrary network request capability with caller-controlled URLs, which is unjustified for a narrowly described image-analysis skill. In practice, such capability can be leveraged for SSRF-like access to internal services, communication with attacker-controlled endpoints, or transferring sensitive data out of the environment.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This cage-cleanliness skill includes shared DAO logic for user identities and token-bearing user accounts, which is unrelated to image-based kennel sanitation analysis. Unnecessary identity/account management expands the attack surface and increases the chance that unrelated sensitive data is stored, queried, or exposed by a skill that should not need it.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The User model stores authentication-like tokens (token, open_token) plus personal profile data (username, realname, email, birthday) without any clear relevance to cage cleanliness detection. Collecting and persisting such data unnecessarily creates privacy, credential-handling, and breach impact risks, especially because SQLite local storage may lack encryption, retention controls, and access restrictions.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs external account provisioning, token acquisition, and authenticated API setup that are unrelated to the stated cage-cleanliness image-analysis purpose. This creates hidden identity and network side effects, expands attack surface, and can cause unauthorized account creation or data transmission under the user's environment without informed consent.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads workspace identity material, reuses existing local identities, and creates new default user identities when none are supplied. For a kennel camera cleanliness detector, silent identity discovery and persistence are unjustified and can bind the skill's activity to internal user context without clear authorization.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code includes generic workspace discovery and automatic creation of data/skills directories beyond what is needed for image-based cleanliness detection. While not directly destructive, this broad environment awareness enables persistence and cross-workspace interaction capabilities that increase risk when bundled into an unrelated skill.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger activates on broadly described cage-floor image or video analysis requests, which can cause the skill to run without sufficiently specific user intent. In a skill that also saves files and contacts cloud services, overbroad activation increases the chance of accidental processing and unintended data transfer.

Vague Triggers

Medium
Confidence
89% confidence
Finding
Automatic activation on broad phrases like '历史报告' can cause cloud-backed retrieval of potentially sensitive prior reports even when the user intent is ambiguous. Because the skill links history to an internal identity automatically, accidental invocation may expose data scope the user did not clearly request.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The workflow states that uploaded attachments are automatically saved locally, but the description does not clearly warn users about this persistence. Silent local retention of user media can create privacy, compliance, and data-handling risks, especially for camera footage from animal-care facilities.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill does not clearly disclose that URL inputs and history queries are sent to remote API services. This is dangerous because users may assume local-only analysis for operational footage, while the skill actually transmits metadata or content to cloud services and may associate requests with internal identities.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The call to resolve_current_open_id performs hidden internal identity initialization without clear disclosure to the operator. Silent identity resolution is dangerous because it can associate requests with an internal account, affect which data is returned, and mask account-scoped behavior that users would not expect from a simple media-analysis tool.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code reads arbitrary local file contents and sends them to an external analysis service without any visible consent prompt, warning, or narrowing to the documented cage-cleanliness use case. In environments handling pet boarding or hospital imagery, this can result in accidental exfiltration of sensitive footage or unrelated local files selected by mistake.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script accepts a hidden API key parameter for a network-backed workflow without user-facing disclosure, which obscures how authentication and remote service usage occur. Hidden sensitive parameters reduce informed consent, complicate auditing, and can lead to accidental secret exposure in automation or misuse of a remote analysis backend under the guise of a local kennel-cleanliness tool.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill reads an internal identity value from data/smyx-api-key.txt without any evident user-facing disclosure or runtime consent. That behavior can expose or repurpose local identity material for unrelated service access, which is especially suspicious in a camera-analysis skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2