Back to skill

Security audit

Reptile Pet Health Diagnosis Tool | 爬行类宠物健康诊断分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill performs the stated cloud reptile-health analysis, but it also silently creates or reuses identities, stores tokens, queries cloud history, and includes out-of-scope camera-monitoring instructions.

Review this before installing if you are comfortable with a cloud-backed workflow that uploads media or remote URLs, associates results with an internally resolved identity, creates or reuses a backend account, stores local tokens, and can list prior cloud reports. Do not treat it as a local-only diagnostic tool, and avoid using it with sensitive media or private/internal URLs unless the publisher's data-handling and account behavior are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares no permissions while its documentation clearly requires shell execution, network access, and local file handling. This mismatch can bypass user or platform expectations about what the skill is allowed to do, increasing the risk of unreviewed data exfiltration or unsafe command execution paths.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The examples introduce continuous camera monitoring and camera management commands that materially exceed the stated skill purpose of analyzing uploaded files or URLs. This scope expansion is dangerous because operators may invoke surveillance-like capabilities without having evaluated them under the declared diagnostic use case.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The skill presents itself as limited to user-supplied videos and URLs, yet later instructs use of monitoring and camera management commands. This inconsistency can mislead users and auditors about the real operational scope, making unintended device access or persistent monitoring more likely.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill exposes a history/listing path that retrieves prior analysis results by OpenID, and the associated CLI flag is hidden from normal help output. This goes beyond the manifest’s stated purpose of analyzing a provided file or URL and creates a privacy risk if identity resolution or OpenID handling is misused, allowing access to prior user data or metadata without clear user consent.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill exposes a report-listing function that returns prior analysis records, which is broader than the manifest's stated purpose of analyzing a provided video. If this method is reachable by the agent/runtime without strict authorization and scope checks, users may access metadata or results from other analyses, creating an unintended data exposure surface.

Context-Inappropriate Capability

Low
Confidence
78% confidence
Finding
The code generates direct report export image links from returned report IDs, even though export-link generation is not described in the manifest. This increases the exposed capability surface and may enable unintended access or sharing of report artifacts if IDs are guessable or links are insufficiently protected server-side.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This file exposes generic add/edit/delete and arbitrary http_get/http_post/http_put/http_delete wrappers that are not constrained to the reptile-health video analysis use case. In an agent skill, this overbroad network capability can be repurposed to access unintended internal or external services, perform unauthorized actions against APIs, or expand the blast radius well beyond the stated functionality.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The get_user_by_username capability introduces user-account lookup functionality unrelated to reptile video health analysis. In an agent context, this can enable unnecessary access to identity data, facilitate user enumeration, and provide a pivot into broader account or directory operations outside the skill's declared purpose.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill defines an `ai_chat` capability that is unrelated to the stated reptile video health-analysis purpose, expanding the skill's effective attack surface beyond its declared scope. Even though the current implementation is stubbed, the code structure and docstring indicate intent to invoke an external agent with user-influenced prompts, which can enable unexpected data flow, privilege use, or later activation of risky behavior without users realizing it.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The utility introduces identity initialization behavior unrelated to reptile video analysis: it reads a workspace API-key file, reuses a local stored account, or silently creates a default user identity. This expands the skill's authority and persistence surface without clear necessity or user disclosure, which is risky in a media-analysis skill context.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The HTTP helper silently logs in or auto-registers a user via /sys/phoneLogin, obtains tokens, and persists them locally. In a skill advertised for reptile health video analysis, hidden account provisioning and token storage are over-privileged behaviors that could enable unauthorized account creation, cross-session tracking, and misuse of backend services.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger rules are broad enough to auto-activate on generic mentions of reptile health or history-report phrases, which can cause the skill to run when the user did not intend to invoke it. Because the skill can process files, URLs, and cloud queries, unintended activation increases privacy and data-handling risk.

Natural-Language Policy Violations

Low
Confidence
73% confidence
Finding
The documentation mandates silent identity handling, fallback to a default local user, and automatic account creation without user visibility or choice. In a health-related context, this can misassociate reports across users and undermines transparency around how personal or quasi-personal identifiers are linked to cloud data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill sends local file content or a user-provided URL to server-side analysis without any explicit user-facing notice that data leaves the local environment. For a health-analysis workflow involving uploaded media, this creates a meaningful privacy and consent risk because users may assume analysis is local when it is actually remote.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill sends either local file contents or user-supplied remote video URLs to a server-side analysis API without any visible notice, consent prompt, or data-handling disclosure in this code path. Because the content may contain sensitive media or internal URLs, silent transmission increases privacy risk and can also enable backend fetching of attacker-controlled URLs.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This request path automatically attaches identifiers and authentication material such as X-Access-Token, X-Api-Key, Authorization, tenantCode, skill metadata, and pnaUserName to outbound requests. Sending identity and token data without clear user-facing notice or strict endpoint scoping creates privacy and credential exposure risk, especially for a skill that users may expect only to analyze uploaded media.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads a sensitive workspace file, data/smyx-api-key.txt, to derive an internal identity value without any visible disclosure or consent flow. Accessing local secret material in a utility for a reptile diagnostic skill increases the chance of covert identity reuse and unexpected linkage between the user's workspace and remote services.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2