Security audit

Pet Excitement Calming Guide | 宠物兴奋过度冷静引导

Security checks for vulnerabilities and agentic risk

Overview

This pet-video analysis skill has a coherent cloud-analysis purpose, but it silently creates/reuses identities, persists authentication tokens, and ships a default development configuration that can send footage and credentials over plaintext HTTP.

Review this before installing. It may upload pet or household video to a remote service, silently create or reuse an internal identity, keep cloud tokens in a local workspace database, and query stored report history. Do not use it with private camera footage unless the publisher fixes HTTPS defaults, documents identity and retention behavior, and provides clear consent and deletion controls.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/config.yaml:15
Finding: Camera Footage, Identity Data, and Authentication Tokens Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:582
Finding: Reusable Authentication Tokens Stored Unencrypted in a Shared Workspace Database
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: skills/smyx_analysis/requirements.txt:3
Finding: Ambiguous YAML Package Name Creates Dependency-Confusion Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding describes a broad set of undeclared capabilities: external HTTP communication with auth/token handling, local filesystem and workspace discovery, reading local open-id/API data, and local database-backed user creation, none of which are necessary from the manifest alone. In context, that is dangerous because the skill is framed as benign pet safety tooling while actually expanding into identity handling, persistence, and generic environment access.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "smyx-excitement-calming-guide-analysis" description: "AI-powered pet over-excitement detection & calming guidance. Real-time camera analysis tracks movement speed, jump height, spin laps, and jumping-on-people actions to score excitement level. When the score exceeds safety thresholds, the system auto-issues calming cues (play owner's voice command like 'sit'/'slow down', soft prompt tone, release calming pheromone, dim lights). Helps prevent injuries from over-excitement and keeps the household safe. Scenarios: lively pet households, pet boarding centers, pet daycare, dog training schools. | 通过宠物活动区的固定摄像头�

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The model stores sensitive and unnecessary personal data for this skill context, including token, open_token, email, realname, birthday, and age. For a pet-calming camera-analysis skill, collecting and persisting these fields is not justified by the stated purpose, creating elevated privacy and credential exposure risk if the database is accessed or reused by unrelated components.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring explicitly states that the function invokes the openclaw agent command via subprocess, and the surrounding comments describe command construction and execution. However, the actual subprocess code is commented out, result is set to {}, and the function never performs the documented agent call, directly contradicting the stated behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility code automatically provisions or reuses platform identities, fetches tokens, and persists them locally, which materially exceeds the stated pet-excitement monitoring purpose. In a skill whose manifest does not justify account lifecycle management, this creates unauthorized identity use, hidden account creation, and credential persistence risks that could expose user accounts or platform resources.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool/permission scope even though the documented behavior clearly relies on filesystem access, shell execution, network access, and likely environment/config reads. In an agent setting, this creates an unnecessary expansion of the trust boundary and makes it harder to constrain or audit what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest promises automatic calming actions and real-time guidance, while the documented operations only support analysis/reporting and history lookup. For a safety-oriented skill, this discrepancy can cause users to rely on non-existent interventions and underestimate the need for direct supervision.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill handles videos, URLs, cloud analysis, and historical report retrieval, but the description does not clearly warn users about privacy implications. Because this involves home/pet camera footage and persistent reports, missing disclosure materially increases consent and data-protection risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: A default trigger on generic pet-video analysis requests is overly broad and can cause unintended activation, file handling, cloud uploads, or script execution when the user did not specifically request this skill. Over-triggering is especially risky for media-processing skills because it may expose sensitive household footage unnecessarily.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The keyword trigger list uses broad phrases without clear boundaries, increasing the chance of accidental invocation. In practice, ambiguous triggers can silently route users into cloud-backed analysis/history features they did not intend to use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes cloud-based history querying and persistent user/report linkage that are not clearly justified by the stated real-time calming use case. This creates unnecessary privacy risk by associating pet/home activity reports with an internal identity and retaining them beyond immediate analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script exposes a history-listing function tied to an internal identity (show_analyze_list(open_id) and --list) even though the skill description only describes real-time pet excitement analysis and calming guidance. Introducing access to historical reports expands the data surface and can leak prior analyses associated with a user identity without any visible authorization checks in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code initializes an internal OpenID-style identity through OpenIdUtil.resolve_current_open_id(...) despite the skill's stated purpose being local/video pet-behavior analysis. Binding analysis and history functions to an internal identity mechanism without a clear need or visible access control increases the chance of unintended user tracking, cross-user data access, or privacy leakage.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2