Pet Excitement Calming Guide | 宠物兴奋过度冷静引导

• Outcome: Review
• Latest audit: Aug 26, 2026 · 5:29 PM UTC
• Version: 1.0.8

Overview

This skill may be useful for pet-video analysis, but it sends sensitive media and identity-linked requests to an external service while silently creating or reusing local account state.

Review before installing. Use this only if you are comfortable sending pet-area videos or video URLs to LifeEmergence cloud services, having an internal identity created or reused automatically, and storing service tokens in a local workspace database. Do not rely on it to actually control speakers, lights, pheromone devices, or other hardware unless those integrations are separately verified and explicitly configured.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The manifest exposes capabilities consistent with environment access, file I/O, networking, and shell execution, but does not declare permissions or clearly warn users about them. This is dangerous because users and orchestrators cannot accurately evaluate the skill's trust boundary, and hidden capability expansion can enable unintended local data access or remote communication.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill advertises real-time pet-behavior monitoring and automatic calming interventions, but the documented behavior instead relies on script-based API submission, identity handling, local persistence, and report retrieval. This mismatch is dangerous because it conceals collection of user identity and historical-report data, preventing informed consent and making it easier to smuggle unrelated account, storage, or tracking behavior into a seemingly harmless analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest claims automatic calming actions and smart-device control, while the documented implementation appears limited to analysis/reporting and API queries. In a skill involving physical-world interventions, overstating automation is dangerous because users may wrongly assume environmental changes or pet-safety actions will occur reliably when they do not, or may fail to understand what systems are actually being controlled.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The implementation accepts arbitrary local file paths and arbitrary remote HTTP/HTTPS video URLs, which is broader than the declared fixed-camera pet excitement analysis purpose. This creates a capability mismatch that can be abused to analyze or exfiltrate unrelated content through the backend analysis service, especially because there is no code-level restriction tying inputs to trusted camera sources or pet-specific scenarios.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The skill exposes report-listing and export-link generation features that are not part of the stated calming-guidance function. Extra data-access functionality increases attack surface and may let users enumerate or retrieve prior analysis artifacts beyond the expected scope of the skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes broad generic CRUD and raw HTTP wrapper methods that can call arbitrary URLs, which significantly exceeds the narrowly described pet excitement detection/calming purpose. In a skill that may process camera-derived or household/device-related data, this creates a powerful exfiltration and unauthorized integration surface if other components can supply attacker-controlled endpoints or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The http_post/http_put/http_get/http_delete methods provide unrestricted outbound request capability, enabling the skill or dependent code to communicate with arbitrary remote services. In the context of a pet monitoring skill that may observe household activity and trigger environmental controls, such unrestricted networking increases the risk of data exfiltration, command-and-control behavior, or abuse of trusted runtime permissions.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file implements generic user-account storage and lookup behavior that is not justified by the declared pet-excitement analysis purpose. In an over-scoped skill, unrelated identity persistence increases the chance of unnecessary collection, retention, and misuse of personal data, especially when paired with update and query helpers.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The model stores token and open_token fields even though a pet-calming camera-analysis skill does not appear to need long-lived authentication secrets. Unnecessary token storage expands the blast radius of any local compromise, backup exposure, logging mistake, or unintended data sharing and can enable account takeover of external services.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer implements remote account provisioning, token acquisition, and user persistence that are unrelated to pet excitement detection/calming. This greatly expands the skill's privileges and allows silent creation or reuse of identities plus outbound authentication flows without a clear user-triggered need, increasing the risk of unauthorized account actions and covert data transmission. In the context of a pet-calming skill, this functionality is especially suspicious because it is outside the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads workspace identity material, searches local user records, and synthesizes default open-id values, then persists them for later reuse. That creates hidden identity state and enables actions to be attributed to generated or harvested identities without transparent user awareness. For a pet behavior analysis skill, this is not justified by function and increases privacy and account misuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The workspace detection code inspects environment variables, traverses filesystem paths, and creates data/skills directories. While not inherently malicious, it grants the skill broader awareness of agent topology and local storage locations than needed for camera-based pet calming guidance, increasing the blast radius for privacy leakage or unintended file access. The mismatch with the stated purpose makes this more concerning.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: A broad default trigger may cause the skill to activate for generic pet-video requests without clear user intent for this specific analysis workflow. Because the skill can save local files and invoke scripts/API calls, over-triggering increases the chance of unnecessary data processing, transmission, and accidental execution in contexts where the user did not knowingly request it.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Broad history-report keywords can automatically invoke cloud report retrieval without sufficiently constraining scope or confirming the user's intent. This is dangerous because history queries may surface prior analysis records and links tied to an internally managed identity, creating privacy risks through accidental disclosure or over-collection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill processes camera-derived media and network-hosted video URLs but does not provide an upfront privacy warning about sensitive visual data and remote transfer. This is dangerous because pet-area footage may reveal household interiors, people, schedules, and other private information, and users may not realize media is being sent to external services or persisted in reports.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill describes automatic physical-world interventions such as pheromone release, dimming lights, and command playback without a clear upfront safety warning or explicit user consent boundary. This is dangerous because environmental actuation can affect animals and people unexpectedly, and users may not understand the risks, limitations, or conditions under which the system will trigger actions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script performs hidden identity resolution through `OpenIdUtil.resolve_current_open_id` while suppressing the `--open-id` help text, reducing user visibility into how identity is selected. In a skill that can list prior analysis reports, opaque identity handling can lead to privacy violations, confusion about account scoping, or unauthorized access if `open_id` can be influenced upstream or defaults to a current internal identity unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code uploads either raw local file content or a supplied remote video URL to an analysis API without any visible consent notice, warning, or minimization step in this file. Because the skill handles video data from homes or pet facilities, silent transmission can expose sensitive environmental or personal information to external services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Enabling HTTPConnection and urllib3 debug logging can expose full request/response metadata, potentially including tokens, identifiers, URLs, and payload contents in logs or stdout. Even if intended only for debug mode, this can leak sensitive data in shared environments or during troubleshooting without any user-facing warning. Because the same file handles auth tokens and user identity, the logging risk is amplified.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code silently reads identity information from data/smyx-api-key.txt and uses it as an internal identity source. This accesses workspace-resident identity material without visible disclosure or opt-in, which can cause the skill to impersonate or reuse an existing account unexpectedly. In a pet-calming skill, that hidden behavior is not proportionate to the stated purpose.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The request wrapper automatically attaches user identity and authentication tokens and performs external HTTP requests, including fallback account creation/login flows, without any visible user disclosure in this file. This can transmit identity, tenant, platform, and token-linked metadata to remote services transparently, creating privacy, consent, and account security risks. Given the stated pet-analysis purpose, the hidden outbound identity traffic is especially dangerous and hard to justify.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This code sends a POST request to a remote login/registration endpoint with openId, mobile, and source fields. That is an external transmission of identity-related data and appears to happen automatically as part of helper logic rather than an obvious user-initiated workflow. In the context of a pet calming skill, transmitting identity to provision accounts is outside expected scope and raises privacy and consent concerns.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-excitement-calming-guide-analysis"
description: "AI-powered pet over-excitement detection & calming guidance. Real-time camera analysis tracks movement speed, jump height, spin laps, and jumping-on-people actions to score excitement level. When the score exceeds safety thresholds, the system auto-issues calming cues (play owner's voice command like 'sit'/'slow down', soft prompt tone, release calming pheromone, dim lights). Helps prevent injuries from over-excitement and keeps the household safe. Scenarios: lively pet households, pet boarding centers, pet daycare, dog training schools. | 通过宠物活动区的固定摄像头实时分析宠物的运动状态，检测狂跳、高速转圈、反复扑人等极度兴奋行为，评估兴奋等级。当兴奋等级超过安全阈值时，自动输出冷静引导指令，包括播放主人的语音口令（如\"坐下\"、\"慢下来\"）、发出柔和提示音，或联动环境设备（如释放宠物镇静信息素、调暗灯光），预防宠物因过度兴奋而撞伤、摔倒或伤人，维护家庭安全。应用场景：宠物家庭（尤其活泼好动的犬猫）、宠物寄养中心、宠物日托班、宠物训练学校。"
version: "1.0.11"
license: "MIT-0"
---

• Confidence: 81% confidence
• Finding: The YARA hit for metadata/tool poisoning is credible in context because the manifest contains exaggerated behavioral claims and capability-signaling inconsistencies, which are common indicators of prompt or tool metadata abuse. Even if not overtly malicious, poisoned metadata can mislead an agent into over-trusting the skill, auto-invoking risky operations, or suppressing scrutiny of undeclared data flows and account handling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2