Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly performs reptile health analysis, but it also silently creates or reuses a cloud-linked identity and stores account tokens locally.
Install only if you are comfortable with uploaded pet media and report history being tied to an automatically managed cloud identity. Review or disable the local token/user database behavior before use in privacy-sensitive workspaces.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
Creating or reusing local identities, persisting tokens, reading workspace files, and auto-registering users are highly sensitive behaviors that are not justified by the stated purpose of visual pet-health analysis. In this skill context, the mismatch makes the functionality more dangerous because users are likely to trust it with personal media while unaware of hidden account linkage and persistence.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "crawl-analysis"
description: "Triggers diagnostic analysis when users provide video URLs or files for reptiles such as lizards, snakes, and spiders. Supports uploading local videos or network URLs to call the server-side API for health checks. It analyzes features like scales, skin, and body appearance to identify potential diseases and generate a Pet Safety Guardian health report. | 爬行类宠物健康诊断分析工具，当用户提供蜥蜴、蛇、蜘蛛等爬行宠物的视频 URL 或文件需要分析时，触发本技能进行爬行宠物健康诊断分析；支持通过上传本地视频或网络�
The skill documentation expands from user-supplied video analysis into 24x7 camera monitoring and camera-management operations. Continuous monitoring is a materially more invasive capability that can introduce surveillance, unauthorized device enrollment, and ongoing data collection far beyond the stated one-off diagnostic purpose.
Camera registration and removal are administrative device-management functions, not simple reptile-health analysis features. In this context, they are especially risky because they could let a skill manipulate surveillance infrastructure under the cover of benign pet diagnostics.
The file implements a generic local database/DAO layer and persistent user-data handling that is not justified by the declared reptile video health-analysis skill. In a mismatched skill context, hidden persistence capabilities expand the attack surface, enable silent retention of user information, and suggest the skill may perform functions beyond user expectations.
The code defines persistent user account/profile storage and mutation operations, including usernames, real names, email, birthday, age, and tokens, none of which are clearly needed for reptile video diagnosis. In this skill context, that makes the capability more dangerous because it could collect or alter personal data without a clear functional need, increasing privacy, compliance, and abuse risk.
The request path can silently call a backend phoneLogin endpoint with register=1 to create or recover user accounts automatically. For a reptile diagnostic skill, hidden account provisioning materially exceeds expected behavior and could cause unauthorized account creation, identity misuse, and opaque backend side effects without informed user action.
The skill advertises and documents capabilities that require shell, filesystem, environment, and network access, but it does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it easier for a deceptive or overbroad skill to obtain sensitive capabilities during execution.
Core skill descriptions and operational instructions are primarily framed in Chinese, and the workflow/output guidance does not offer the user a language choice for responses or reports. This can violate language or locale policy if the skill forces a specific language without explicit user opt-in.
The capability summary describes analysis and report generation, while later examples introduce monitoring-management commands not reflected in that scope. Inconsistent scope disclosure can cause reviewers and users to underestimate what the skill can do, leading to over-granting of privileges.
The trigger conditions are broad enough that ordinary mentions of reptiles, diagnosis, or uploaded media could auto-invoke the skill without strong intent verification. Overbroad automatic invocation increases the chance of unintended file handling, network calls, and privacy-sensitive processing.
The history-report query triggers auto-execute on a wide set of phrases without clear limits on account scope or data sensitivity. That can expose prior reports or metadata unexpectedly, especially when combined with implicit identity association described elsewhere in the skill.
This code file contains multiple natural-language strings in Chinese for errors, status messages, and help text, indicating the skill forces a specific language experience. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as region-specific and justified, which is not present here.
The show_analyze_list function exposes a capability to retrieve prior analysis records by open_id, and the validation that would require an ID is commented out. This is unrelated to the advertised purpose of analyzing a supplied reptile video and creates a hidden data-access surface that could enable enumeration of historical user records if the downstream API accepts caller-controlled or ambient identity.
The script initializes and uses internal OpenID identity handling even though the skill description only mentions video/file or URL inputs for analysis. Introducing undisclosed identity resolution broadens the trust boundary and may bind actions or data retrieval to an internal account context without transparent user awareness.
The code performs internal OpenID resolution without any user-facing disclosure, which is a privacy and transparency problem in a skill advertised as simple video analysis. Hidden identity handling can surprise users and, combined with listing/history features, may lead to unauthorized access or correlation of prior analysis data under an internal account context.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Detected: suspicious.install_untrusted_source