Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed cloud video-analysis wrapper, but it silently manages identity and tokens and ships with unsafe plaintext development endpoints.
Review before installing. Expect uploaded barn media or supplied video URLs, an internal identity, and report-history requests to be sent to the vendor service; do not use this package unless the configuration is changed to HTTPS production endpoints and you accept workspace storage of identity and tokens.
skills/smyx_common/scripts/config-dev.yaml:2Sensitive Media, Identity Data, and Authentication Tokens Transmitted over Plaintext HTTP
skills/smyx_common/scripts/util.py:586Reusable Authentication Tokens Stored Unencrypted in a Shared Workspace Database
skills/smyx_analysis/requirements.txt:1Ambiguous YAML Dependency Declaration Creates Supply-Chain Risk
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
The combination of external HTTP communication, token management, local identity persistence, filesystem inspection/creation, and absent domain-specific processing is a strong indicator that the skill’s real capabilities exceed its stated purpose. This is dangerous because deceptive or incomplete disclosure can cause sensitive media and user context to be transmitted, stored, and linked in ways reviewers and users do not expect.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-estrus-mating-behavior-detect-analysis"
description: "Detects estrus behavior in female livestock from continuous barn videos — including mounting acceptance, standing reflex, restlessness, appetite drop and vulva changes — and outputs an estrus recognition result with the optimal mating time window. | 识别母畜发情期行为特征（爬跨、静立反射等），优化配种时机。"
version: "1.0.8"
license: "MIT-0"
---
# 💞 Livestock Estrus & Mating Behavior Detection | 畜禽发情/配种行为识别
> 识别母畜发情期行为特征（爬跨、静立反射等），优化配种时机。
>
> **精准繁殖识别中
The code reads a workspace identity file and, if absent, creates and persists a default user identity in local storage. For an estrus-detection skill, silent identity discovery and persistence are unjustified and dangerous because they establish durable tracking identifiers without clear necessity or user awareness.
The utility layer performs broad tokenized API interaction, user identity resolution, and account lifecycle behavior unrelated to livestock estrus-video analysis. This creates an unnecessary data-exfiltration and unauthorized external-service interaction surface, especially because the code automatically attaches identity fields and tokens to outbound requests.
This code can silently self-register or log in a user against an external health platform using generated or recovered identifiers. That behavior is unrelated to the stated livestock-analysis purpose and could create unauthorized accounts, transmit identity data off-device, and bind local activity to an external service without informed consent.
The request layer automatically transmits identity-linked fields and authentication headers such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName. In a skill whose purpose is livestock estrus recognition, this undisclosed outbound sharing is disproportionate and creates significant privacy, account-abuse, and credential-exposure risk if endpoints are misused or compromised.
The skill declares no explicit tool scope or permissions, yet the manifest instructs use of shell commands, local file handling, network access, and references environment/config usage. This creates an overprivileged, weakly-bounded execution surface where an agent may invoke sensitive capabilities without transparent least-privilege constraints.
The history-report trigger phrases are broad enough that ordinary user language could unintentionally invoke cloud history retrieval. This can cause unintended disclosure of account-linked report metadata or actions beyond the user’s immediate request, especially because the skill mandates direct API querying.
The skill states that uploaded files are automatically saved locally, but it does not clearly warn users about storage location, retention, access controls, or deletion behavior. Automatic local persistence of media increases privacy and data-handling risk, particularly for continuous video files that may contain sensitive operational information.
The parser description and surrounding help text present the tool as a livestock estrus/mating behavior recognizer, but the --pet-type option contradicts that by documenting only cat, dog, and other. This is an active intent/documentation conflict that would mislead users about what species and use case the tool actually supports.
The manifest describes a specialized skill for detecting estrus behavior in female livestock from barn video, but the exposed interface asks for a generic pet-type of cat, dog, or other. This indicates the implemented skill is not actually scoped to livestock-specific estrus analysis as claimed, but instead appears repurposed from a broader or different animal-analysis workflow.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, which expands behavior beyond the stated local barn-video analysis scope. This can enable unintended access to external resources, privacy issues, and possible server-side request misuse if the downstream service fetches attacker-controlled URLs.
Detected: suspicious.install_untrusted_source