ClawHub
Back to skill

Security audit

Pet Eye Anomaly Detection (Redness / Tearing / Cataract) | 宠物眼睛异常识别（红肿/流泪/白内障）

Security checks across malware telemetry and agentic risk

Overview

This pet-eye analysis skill should go to Review because it silently creates or reuses an identity, sends media and account data to remote services, and persists authentication tokens locally.

Install only if you are comfortable with pet images or videos, report metadata, and an automatically generated or reused identity being sent to the service. Review and correct the endpoint configuration before use, because the packaged config currently points to dev HTTP addresses, and avoid using sensitive media unless token storage and retention are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
This method applies filter keys directly via getattr(self.__model__, key) without validating them against an allowlist. While SQLAlchemy still parameterizes values and prevents classic SQL injection, untrusted callers can trigger unauthorized querying on sensitive columns or cause exceptions/behavior differences by selecting unexpected model attributes, which is risky in a generic DAO handling user records and tokens.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
Like the list() path, count() accepts arbitrary filter keys and resolves model attributes dynamically. In a generic user-data DAO this can enable probing of sensitive account fields, record existence inference, or application instability through unexpected attribute resolution, even if it does not result in direct SQL injection.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and instructs use of file read/write, shell execution, environment handling, and network access, yet declares no permissions or trust boundaries. This creates a capability-transparency gap: operators and policy layers may not realize the skill can persist user files locally and invoke remote APIs via scripts, increasing the risk of unintended data access or execution.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script exposes a hidden `--list` mode that retrieves historical analysis reports, which is outside the advertised eye-anomaly analysis purpose in the manifest. Hidden data-access functionality increases the attack surface and can enable unauthorized enumeration of prior user results if invoked by a caller who was not clearly informed this capability exists.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code resolves and initializes an internal user identity before normal operation, despite the skill's stated function being local/remote pet eye analysis. Coupling identity resolution to analysis creates unnecessary privacy and access-control risk, especially because it can influence later retrieval of user-associated records without a clear user-facing need.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file exposes generic network primitives and CRUD-style wrappers that can call arbitrary URLs, which materially exceeds the stated purpose of a narrowly scoped pet eye anomaly detection skill. In a skill context, such broad outbound request capability increases the attack surface for unauthorized data exfiltration, unintended backend access, or hidden secondary behaviors if other components can influence the URL or payload.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The add, edit, and delete helpers provide remote state-changing operations that are not justified by the manifest's primarily analytical, read-like use case. Even if intended as shared utility code, these write/delete capabilities could be repurposed to alter or remove remote resources when invoked by other parts of the skill or by compromised inputs.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The file defines generic user/account persistence logic, including lookup and update behavior for user records, which is not clearly necessary for a pet eye anomaly detection skill. Capability overreach increases privacy and abuse risk because the component can manage identity-linked records independently of the stated medical-image analysis purpose.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, but the declared skill purpose is pet eye anomaly analysis. Collecting and persisting credentials or session-like tokens without clear necessity materially increases the impact of compromise and creates avoidable privacy and authentication-data exposure risk.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility file contains broad identity resolution, account provisioning, token management, workspace inspection, and billing logic that materially exceeds the stated purpose of pet eye anomaly detection. In a medical-adjacent image-analysis skill, this hidden cross-cutting behavior increases the attack surface and creates undisclosed collection and use of user identity and account state.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code reads a workspace file for an internal identity value and, if absent, creates a persistent default user identity in local storage. That behavior is unrelated to eye-anomaly detection and can silently bind activity to a long-lived identifier without user awareness, enabling tracking and unintended account linkage.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The request path silently performs remote registration/login using openId/mobile values, retrieves tokens, and stores them locally for reuse. For a pet eye screening skill, this is unjustified hidden authentication behavior that can create accounts, transmit identifiers off-device, and persist credentials without transparent user authorization.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Embedding recharge and payment instructions inside generic request handling shows the skill is wired for monetization/account workflows beyond its declared diagnostic purpose. While not directly an exploit primitive, it confirms hidden platform coupling and increases the risk of deceptive or unauthorized commercial interactions from within a health-related skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that uploaded attachments or media will be automatically saved as local files, but it does not clearly warn the user about retention, storage location, lifetime, or potential downstream access. For health-related pet images/videos, silent persistence can expose sensitive household imagery and create unnecessary data residue on the host.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill mandates direct cloud API calls for history-report retrieval, but the description does not clearly tell users that their report metadata will be fetched from a remote service. This weakens informed consent and can surprise users about off-device data access and transmission tied to internally managed identity linkage.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
`OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` performs hidden identity resolution using an internal identifier that is suppressed from help output, which obscures to users that identity context is being established. This is dangerous because undisclosed identity handling can enable silent association of actions or history access with a user account, undermining transparency and potentially allowing privacy violations.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill reads arbitrary local file contents and submits them to an external analysis service without any visible consent, confirmation, or path restriction in this code. In an agent setting, this can cause unintended exfiltration of sensitive local media if a user or another component passes an unexpected path.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code reads an identity value from data/smyx-api-key.txt and uses it as an internal identifier source without any visible disclosure or consent. This creates a covert identity channel from local workspace state into the skill's account logic, which is especially inappropriate for a narrowly described pet eye analysis tool.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
HTTP requests attach App-Id, access tokens, API keys, authorization tokens, tenant and platform metadata, and pnaUserName, with automatic enrichment of request bodies. Even if sent over HTTPS, undisclosed transmission of identity and authentication data from a pet eye detector is a privacy and security concern because users would not reasonably expect this level of backend tracking and account propagation.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
88% confidence
Finding
This specific external transmission sends openId/mobile-based registration data to a remote /sys/phoneLogin endpoint. Network transmission itself is not always a vulnerability, but here it is security-relevant because it performs account creation/login unrelated to the declared eye-anomaly detection workflow and exports identifiers off-device without clear disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2