Estrus/Mating Behavior Detection | 畜禽发情/配种行为识别

• Outcome: Review
• Latest audit: Aug 27, 2026 · 12:14 AM UTC
• Version: 1.0.10

Overview

The skill mostly matches livestock video analysis, but it silently creates and reuses identities, stores auth tokens locally, and sends media and identifiers to remote services with weak user control.

Install only if you are comfortable with barn media and report metadata being sent to the configured backend, with the skill creating/reusing a local identity and storing returned auth tokens in the workspace data area. Review endpoint configuration before use, especially because the bundled dev config uses plain HTTP private-network addresses.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 83% confidence
• Finding: This getattr(self.__model__, key) uses filter keys supplied at runtime without validating that the attribute is an expected column. An attacker who can influence filters may trigger unexpected attribute access, exceptions, or query behavior against unintended model properties, creating a denial-of-service or authorization-bypass-adjacent risk depending on callers.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 83% confidence
• Finding: Like the list() method, count() builds filters from arbitrary runtime keys using getattr() on the model class with no allowlist. If untrusted input reaches this method, it can cause crashes or access to unintended ORM attributes, making the generic DAO easier to abuse than purpose-built query methods.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill manifest exposes capabilities to read/write local files, invoke shell commands, access environment data, and make network requests, yet it declares no permissions or user-facing disclosure of those powers. This undermines informed consent and prevents policy enforcement, especially because the workflow explicitly saves uploads locally and executes Python modules that contact backend services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to perform livestock estrus detection, but the documented behavior also includes hidden identity creation/reuse, remote authentication, cloud report retrieval, and report listing not clearly represented in the high-level description. This mismatch can conceal sensitive data handling and cross-session tracking, making users and reviewers underestimate the privacy and security impact.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script exposes a hidden report-history listing path via `--list` and `show_analyze_list(open_id, ...)`, even though this capability is not reflected in the stated skill purpose. Because identity is resolved through an internal/current open ID mechanism and can also be influenced by a hidden `--open-id` parameter elsewhere in the file, this creates a privacy and authorization risk: prior analysis reports may be enumerated or retrieved outside the user's expected action.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The comment says identity initialization does not require user input and is hidden from help, but the code still accepts `--open-id` and passes it into identity resolution. This mismatch is dangerous because it obscures a security-relevant input path from users and reviewers, increasing the chance of identity spoofing, confused-deputy behavior, or accidental exposure of another user's report context.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This service exposes broad generic CRUD and arbitrary HTTP helper methods (add, edit, delete, http_get/post/put/delete) that are not constrained to the stated estrus-detection purpose. In a skill context, such overbroad network capabilities increase the attack surface and can be repurposed to access, modify, or exfiltrate unrelated data or call unintended internal/external services if other parts of the skill can influence the URL or payload.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The get_user_by_username capability introduces user-account lookup functionality that is unrelated to livestock estrus video analysis. Even if intended for convenience, unnecessary identity lookup features can enable user enumeration, privacy violations, or pivoting into account-focused workflows outside the advertised scope of the skill.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file implements generic user-account persistence, including identity lookup and default-user reuse, which is unrelated to livestock estrus video analysis. In a mismatched skill context, hidden identity-management logic increases the attack surface and raises concern that the skill may collect or retain user data beyond its declared purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores usernames, real names, email, token, and open_token despite the skill being described as estrus-behavior detection from barn video. Collecting and persisting authentication-like secrets without a clear functional need creates unjustified privacy and credential exposure risk, especially because the tokens appear to be stored in plaintext.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: A full create/read/update/delete database layer exceeds the declared analysis-oriented purpose of the skill and enables broad local state mutation unrelated to estrus recognition. Even without a direct exploit primitive, this enlarges persistence and tampering capability inside the skill and makes misuse more likely.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes a generic `ai_chat` capability that is unrelated to estrus-video analysis and broadens the skill's effective privilege and attack surface. Even though the subprocess invocation is currently commented out/broken, shipping an agent-chat helper in a domain-specific livestock analysis skill creates a latent execution pathway that could later be enabled or reused for unintended model/tool access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The utility layer performs remote account provisioning and login flows that are unrelated to estrus-video analysis, including creating/fetching user identities and attaching tokens to outbound requests. In a domain-specific livestock analysis skill, this hidden authentication and network activity materially expands the trust boundary and can transmit user-linked identifiers to external services without a clear need tied to the stated function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code generates synthetic open IDs, persists them locally, and reuses them as default identities when no explicit user identity is supplied. Creating durable pseudo-identities unrelated to the skill's livestock-analysis purpose can silently impersonate or track users across requests and enables undisclosed linkage between local state and remote services.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code inspects environment variables and filesystem paths to discover the agent workspace, then creates shared data and skills directories. While not directly exploit code, this broad workspace discovery and write capability is unrelated to estrus detection and increases the chance of cross-skill data access, unexpected persistence, or modification of shared agent state.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are broad enough to auto-activate on common breeding or livestock keywords combined with media, increasing the chance the skill runs without clear user intent. Because the skill can save files locally and query remote history automatically, accidental invocation can lead to unnecessary data collection or unintended access to historical reports.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that uploaded attachments are automatically saved as local files, but this behavior is not prominently warned in the description or consent flow. Silent local persistence of user-provided media creates privacy and retention risks, particularly for continuous barn video that may contain operationally sensitive footage.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs hidden internal identity resolution through `OpenIdUtil.resolve_current_open_id(...)` without clear disclosure to the user. In a skill that can also list prior reports, silent identity binding increases the risk of unauthorized data access, privacy violations, and misuse of internal account context, especially because the identity source is not transparently presented to the operator.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code reads a local video file into memory and uploads it to an external analysis API, but this file does not provide any visible user-facing disclosure, consent prompt, or privacy warning before transmission. Because the skill processes continuous barn video, uploads may include sensitive operational footage, workers, or other unintended content, creating privacy and data-governance risk if users are unaware of the transfer.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script accepts a hidden `--api-key` parameter and supports network-backed analysis/API usage while suppressing this credential-related behavior from normal help output. That reduces transparency around secret handling and data transmission, increasing the risk that users unknowingly send video data and credentials to a remote service without informed consent or proper operational safeguards.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: These helper methods create directories and open files for writing with no guardrails, user disclosure, or path restrictions. In the context of a video-analysis skill, silent filesystem writes are not obviously required and can be abused by other code paths to persist data unexpectedly or overwrite files within accessible workspace locations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The request wrapper automatically attaches tokens, API keys, tenant codes, skill hub metadata, and usernames to outbound HTTP requests, and may also trigger account creation flows. In a livestock estrus-analysis skill, silently transmitting identifiers and credentials to external endpoints is risky because it can expose user-linked data and create undisclosed external dependencies far beyond the advertised functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: This POST sends an openId/mobile/source payload to a remote login endpoint to provision or retrieve an account. External transmission of user-derived identifiers is especially concerning here because it is unrelated to the stated estrus detection purpose and occurs as part of utility code rather than an explicitly user-invoked authentication step.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 识别结果仅供发情/配种时机参考，本技能不提供配种操作或繁殖管理建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 72% confidence
• Finding: The finding suggests hidden or non-printing instruction content in the manifest area, which can be used to alter model behavior in ways not visible to reviewers. In agent skills, invisible directives are risky because they can conceal operational constraints or manipulative instructions that bypass normal review and user understanding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-estrus-mating-behavior-detect-analysis"
description: "Detects estrus behavior in female livestock from continuous barn videos — including mounting acceptance, standing reflex, restlessness, appetite drop and vulva changes — and outputs an estrus recognition result with the optimal mating time window. | 识别母畜发情期行为特征（爬跨、静立反射等），优化配种时机。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 78% confidence
• Finding: The metadata contains indicators consistent with tool/manifest poisoning, and the surrounding file includes strong behavioral directives that can steer the agent's execution path beyond the simple advertised purpose. In this context, poisoned metadata is dangerous because the skill already mixes remote API use, identity handling, local persistence, and automatic report retrieval, creating a larger attack surface for deceptive orchestration.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2