Pet Cage Cleanliness Detection | 宠物寄养笼舍清洁度识别

• Outcome: Review
• Latest audit: Oct 27, 2026 · 2:57 AM UTC
• Version: 1.0.14

Overview

The skill needs review because its “export-only” option can still upload footage and its request helper lacks safeguards against sending credentials to unintended destinations.

Have the export-only behavior and authenticated destination checks corrected before using sensitive footage. Confirm the Life Emergence service’s retention and account practices, and use only media you are authorized to share.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied chunk manages local user data rather than camera images, waste detection, coverage calculations, thresholds, or cleaning alerts. Database access alone could be a supporting implementation detail, but this code specifically implements user identity and token persistence not described in the declared purpose. No image-analysis or alerting behavior is present in this chunk. The finding is limited to the supplied code; it does not establish malicious intent or external data transmission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The reported attachment of API keys and access tokens to caller-supplied absolute URLs creates a credential-disclosure path if an attacker can influence the request destination. Identity initialization and billing support are not inherently malicious, but sending service credentials outside a trusted origin is unrelated to legitimate media analysis; this behavior is reported by the static finding and cannot be independently verified from SKILL.md alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The supplied code accepts video inputs and delegates analysis to skill.get_output_analysis. It also resolves an open ID and exposes a --list operation calling skill.get_output_analysis_list. No visible logic schedules camera captures, identifies excrement, calculates floor coverage, applies a cleanliness threshold, or triggers cleaning alerts. The imported analysis implementation is not supplied, so specialized detection could exist there; however, this chunk does not establish the declared workflow and adds an undeclared identity-linked history capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

The supplied code validates and uploads files or forwards video URLs, then retrieves and formats analysis reports. It does not contain cage-specific analysis parameters or the monitoring and alerting behavior central to the description. Uploading media and polling results could support the declared purpose, but those supporting operations alone do not establish the advertised functionality. The imported analysis service might implement some of it, so this finding is limited to the supplied code chunk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-cage-cleanliness-detection-analysis"
description: "AI-powered cage cleanliness detection via fixed cameras in boarding kennels/pet shops; analyzes floor images to detect feces/urine coverage area ratio, triggers cleaning alerts when exceeding preset threshold (e.g. 5%). Scenarios: pet boarding centers, pet shops, animal hospitals, breeding facilities. | 通过寄养中心或宠物店笼舍内的固定摄像头，定时分析地面图像，识别粪便、尿液等排泄物的覆盖面积占比，当超过预设阈值（如5%）时自动触发清洁提醒。该技能可帮助管理人员及时清理笼舍，维持环境卫生，预

The HTTP helper can forward service credentials to arbitrary absolute URLs.

High

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The helper accepts any absolute HTTP or HTTPS URL and then attaches service tokens and the API key without checking the destination origin. If a caller passes an attacker-controlled URL, those credentials and identity metadata can be disclosed; accepting plain HTTP also permits interception in transit.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The analysis workflow lacks a privacy warning about submitting user media or media URLs to a remote API.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow directs processing of local media through a remote service without a clear pre-upload privacy notice or authorization boundary. Although cloud processing is mentioned elsewhere, facility footage can contain staff, customers, operational details, or access-bearing media URLs, making unintended third-party disclosure consequential.

Content

No source excerpt is available for this finding.

The documented --export-env-only mode still executes image/video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only option promises not to perform analysis, but args.export_env_only is never checked; with --input or --url supplied, execution still reaches skill.get_output_analysis(). This violates an explicit no-execution boundary and could cause unintended processing or, if the underlying implementation uses remote services, transmission of potentially sensitive facility footage, although that implementation is not shown. Identity initialization and history retrieval can also occur despite this flag.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are submitted to the analysis API without disclosure of the upload.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The code reads the entire local file and passes its contents to the analysis API without a visible disclosure or consent check. Camera footage from kennels or animal hospitals may capture staff, customers, or sensitive facility details, making undisclosed external processing a privacy risk. Uploading media is consistent with the skill's analysis purpose, so this is not evidence of malicious exfiltration; the API destination and any disclosures elsewhere are not available for review.

Content

No source excerpt is available for this finding.

The documented export-only mode still executes analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag promises not to execute analysis, but its parsed value is never checked. When an input path or URL is supplied, execution still calls skill.get_output_analysis, potentially uploading private kennel footage or consuming paid API resources despite the user's explicit request to avoid analysis; the downstream implementation is not shown, so actual transmission cannot be confirmed.

Content

No source excerpt is available for this finding.

The skill includes persistent personal-profile and credential management unrelated to cage cleanliness analysis.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The User model stores names, email addresses, birthdays, sex, age, and authentication tokens, while UserDao exposes inherited CRUD operations on these records (L470-L473). DAO initialization also creates and migrates the sys_user table (L184-L215). Managing these personal profiles and credentials is not justified by the stated purpose of analyzing cage-floor images and issuing cleaning alerts.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation but never executes it or returns an analysis result.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The docstring at L26 states that this method invokes the openclaw agent through subprocess, but the invocation at L61–L66 is commented out. Instead, L68 initializes a dictionary and L70 accesses its nonexistent stderr attribute; the resulting exception is caught at L81–L82, so the method returns None without performing the documented analysis.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The generic open helper always uses mode 'w', which immediately erases an existing file's contents. There is no confirmation, operation log, docstring, or comment explaining that calling this helper creates or truncates the target file; exception reporting does not disclose successful truncation.

Content

No source excerpt is available for this finding.

HTTP requests can silently register a remote account and persist its credentials, beyond the described image-analysis and cleaning-alert workflow.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

An ordinary API request can implicitly trigger remote account registration, transmit the selected identity, and persist returned authentication tokens through UserDao. These account-management side effects are not apparent from the cage-analysis description and create privacy and credential-lifecycle risks; the provided file does not establish whether another component obtains consent or protects stored credentials.

Content

No source excerpt is available for this finding.

Automatic remote login or registration transmits the current identity without disclosure.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The automatic login/registration request copies the selected identity into both openId and mobile, and the caller can select ApiEnum.API_SECRET_KEY as that identity. This can unnecessarily propagate a credential into account identity fields and associated backend records or logs; this overlaps with SDI-1 rather than establishing a separate malicious transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

The example expands automatic activation to the generic phrase “历史报告” (“historical reports”).

Low

• Category: Trigger Abuse
• Confidence: 96% confidence

Finding

Automatically treating the generic phrase “historical reports” as authorization for this skill can initiate an unrelated cloud query and display user-associated cage reports. The impact is limited because this is a read-only operation and the phrase may be appropriate within an established cage-cleanliness conversation, but the trigger is too broad outside that context.

Content

No source excerpt is available for this finding.

Configuration loading silently creates directories and files, including during module import.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is missing, without a log, confirmation, or explanatory comment or docstring. BaseEnum.init_subclass invokes this loader during class definition (L052–L058), so importing the module can modify the filesystem without an explicit save action.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()