Pet Ear Health Snapshot & Redness Recognition | 宠物耳道健康抓拍与红肿识别

• Outcome: Review
• Latest audit: Aug 3, 2026 · 4:43 AM UTC
• Version: 1.0.5

Overview

The skill’s pet ear analysis is coherent, but it silently creates or reuses account identity, stores tokens locally, and can retrieve cloud history reports with limited user control.

Review this before installing if you are not comfortable with pet media or URLs being sent to the provider’s cloud service, a local identity being created or reused automatically, tokens being stored in a workspace SQLite database, and prior reports being fetched from the cloud when report-history language is used.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no declared permissions while its documented behavior clearly requires shell execution, file read/write, environment access, and network access. This mismatch undermines trust boundaries and can cause the platform or user to approve a skill without understanding that uploaded media may be saved locally and sent to remote services.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is framed as a visual ear-health analyzer, but it also performs cloud history-report retrieval tied to an internally managed identity. That materially expands the data-access scope from single-file analysis to account-linked report access, increasing privacy risk and creating a mismatch between user expectations and actual behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script contains a hidden `--list` mode that retrieves prior analysis reports by `open_id`, which goes beyond the stated purpose of analyzing a provided video or file. Undocumented access to historical records increases the risk of privacy violations, unauthorized data exposure, and abuse if callers can influence or infer another user's identity.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code resolves and uses an internal OpenID-based identity even though the skill's visible function is local/media visual analysis. Introducing hidden identity handling expands the data collection surface and can enable account linkage, tracking, or access to user-scoped backend data unrelated to the user’s immediate request.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements a generic persistence layer with create, update, delete, and lookup operations for user/account data that materially exceeds the declared pet ear-health video/image analysis purpose. In a skill whose stated function is visual anomaly detection, retaining broad account-management capabilities expands the attack surface and enables unnecessary collection or mutation of user data, especially when combined with token-bearing fields in the model.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores identity fields and sensitive credential-like material such as token and open_token, which are not justified by the manifest's ear-health analysis function. Unnecessary token storage increases the blast radius of compromise, and the mismatch between declared purpose and implemented data handling is especially concerning in a consumer-facing pet-health skill where users would not reasonably expect account credential persistence.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The utility code provisions users, retrieves tokens, persists them locally, and injects authentication material into outbound requests, which materially exceeds the stated purpose of pet ear-image analysis. In a skill context, this creates an unnecessary identity-management and credential-handling surface that could enable unauthorized account creation, token reuse, and cross-skill data access if abused or misconfigured.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads data/smyx-api-key.txt and treats its contents as an open-id/identity source for requests. For a visual pet-health screening skill, pulling local workspace identity material is unnecessary and dangerous because it silently binds requests to whatever identity happens to be present on disk, increasing the risk of impersonation, data leakage, or unintended API actions under another user's context.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code auto-generates synthetic local users and persists them when no open-id is available, creating implicit identities without clear user consent or business need. In this skill's context, that behavior is especially concerning because it can trigger backend account creation and ongoing activity under fabricated identities unrelated to the user's request for ear-health analysis.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill accepts local files and network URLs, saves attachments locally, and queries a cloud API, yet it does not clearly warn users that media and generated reports may be transmitted to and stored by remote services. This omission can lead to unconsented exposure of potentially sensitive pet-owner data, links, and account-associated history.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The default trigger activates on broadly described ear-related videos or files without strong scoping or confirmation. Overbroad triggers can cause the skill to process unintended attachments or URLs, increasing the chance of unnecessary data collection, network calls, and accidental invocation of sensitive workflows.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: History-report retrieval is triggered by broad everyday phrases such as viewing historical reports, without clear confirmation or scoping. Because the skill auto-associates an internal identity, ambiguous language could cause unintended disclosure of prior cloud-stored reports to the wrong conversational context or without sufficient user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` performs hidden internal identity resolution without clear disclosure in the user-facing interface. Silent identity binding is dangerous because it can surprise users, undermine privacy expectations, and create an avenue for accessing or correlating user data without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends either a user-supplied remote video URL or the full contents of a local file to an external analysis service without any in-file user notice, confirmation, or consent gating. Because the skill handles pet-health media, this can expose potentially sensitive household imagery, metadata, or third-party URLs to external systems in a way the user may not reasonably expect.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function forwards a local file path or remote URL to `skill.get_output_analysis(...)`, which likely causes video content to be sent to a backend service, but the script does not provide any explicit notice, consent prompt, or privacy warning before doing so. Because this skill processes pet health videos and may capture close-up ear imagery, users may unknowingly upload sensitive household or owner-associated media to a remote service.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 91% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供健康参考，不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，API 服务会自动下载 |
| 📁 格式支持 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown 表格格式输出，包含"报告名称"、"宠物类型"、"分析时间"、"点击查看"四列，其中"报告名称"列使用`宠物耳道健康分析报告-{记录id}`形式拼接, "点击查看"列使用 `[🔗 查看报告]()` 格式的超链接，用户点击即可直接跳转到对应的完整报告页面 |

• Confidence: 86% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-ear-health-snapshot-analysis"
description: "Triggers when a user provides a pet ear/scratching/head-shaking video URL or file for analysis; uses smart camera to monitor head-shaking and ear-scratching actions, automatically captures HD ear-canal images, and applies AI vision analysis to identify ear-canal color (pink/red/dark red), presence of black granular discharge (ear mites), and degree of earwax accumulation. When redness, large discharge or suspected ear mites are detected, outputs abnormality alerts and recommends owner check-up or veterinary visit. Application: pet families, boarding centers, pet hospital pre-screening. Helps early detection of ear-canal diseases and prevents deterioration. | 当用户提供宠物甩耳、挠耳或耳道抓拍视频URL或文件时，触发本技能进行耳道健康监测分析；通过智能摄像头实时监测甩耳/挠耳动作，自动触发高清抓拍耳道内部图像，利用AI视觉分析识别耳道颜色（粉红/红/暗红）、有无黑色颗粒状分泌物（耳螨）、耳垢堆积程度等异常指标；当检测到红肿、大量分泌物或疑似耳螨时，输出异常提示，建议主人进一步检查或就医，仅输出基于视觉的客观描述与建议，不提供医疗诊断。应用场景：宠物家庭日常健康监测、寄养中心批量监控、宠物医院预检。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 84% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2