Pet Eye Anomaly Detection (Redness / Tearing / Cataract) | 宠物眼睛异常识别（红肿/流泪/白内障）

• Outcome: Review
• Latest audit: Oct 12, 2026 · 7:08 AM UTC
• Version: 1.0.10

Overview

This skill appears to be a real cloud-based pet eye analysis client, but it silently creates or reuses a user identity, stores tokens locally, and uploads media to external services with limited user-facing privacy disclosure.

Install only if you are comfortable with pet images/videos and report history being processed by the publisher's cloud service, with a generated or reused identity and locally stored tokens. Prefer explicit consent before uploads or history queries, and avoid using sensitive home footage unless the publisher documents retention, deletion, and account-scope controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as pet eye anomaly detection, but the detected behavior includes generic remote API access, local persistence, user/account handling, report listing, and broader backend operations unrelated to that claim. This mismatch is dangerous because it can hide data collection, identity linkage, or remote service interaction behind an innocuous medical-analysis description, undermining informed consent and review.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-eye-anomaly-detection-analysis"
description: "AI-powered pet eye anomaly detection from close-up facial images/video. Detects conjunctival redness, abnormal tearing/tear stains, and pupil/cornea opacity (cataract / corneal edema), then outputs anomaly alerts to help owners catch eye disease risks early. Scenarios: daily home health self-check, boarding center routine inspection, animal hospital triage, senior pet cataract monitoring. | 通过宠物摄像头捕捉宠物面部近景视频，利用AI视觉分析技术检测眼部充血（结膜颜色发红）、异常流泪（泪痕严重或持续性溢泪）、瞳孔区域浑�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility file contains identity resolution, token handling, local user persistence, and remote account provisioning logic that is unrelated to pet eye anomaly detection. Such hidden auth/account-management behavior materially expands the skill's privilege and data-handling scope, creating risk of undisclosed user tracking, token misuse, and unexpected network-side account creation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code can silently register/login a user against an external health endpoint using generated or reused identifiers. For an image/video pet-eye analysis skill, this is out-of-scope behavior that may create external accounts and transmit identity data without informed user action, increasing privacy and abuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic network authentication and possible user registration are performed silently during request setup. Because the skill's stated purpose is pet-eye anomaly detection, this hidden remote side effect is especially dangerous: it can transmit identifiers and create service accounts without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generic HTTP helper automatically injects tokens, API keys, and user identifiers into outbound requests and can send arbitrary data to external URLs. In a skill that should primarily analyze local pet images/video, this creates a broad undisclosed exfiltration and account-linkage surface, especially since these requests can be triggered as part of shared utility behavior rather than obvious user actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell, network, file read/write, and environment-dependent behavior but declares no explicit tool scope or permissions boundaries. This increases the chance that a host agent grants broader capabilities than users expect, making later misuse of local files, shell execution, or outbound requests harder to detect and contain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill accepts local files and network URLs and routes processing through a cloud API, but the description does not clearly warn users that media and remote content may be transmitted off-device. This lack of transparency is dangerous because users may upload sensitive pet/home imagery without informed consent about external processing and retention.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The default trigger is broad enough to activate on general image or video analysis requests, which can cause the skill to run unexpectedly and process media outside the user's intended scope. Because the skill also uses remote APIs and local file handling, accidental activation can lead to unintended data transmission or storage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill mandates cloud-based historical report retrieval and automatic local user creation/reuse, even though those behaviors are broader than simple eye-image analysis. That creates unnecessary identity persistence and remote data access, increasing privacy exposure and the risk of cross-session or cross-user data mixing if the default identity mechanism is weak.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The automatic history-report query trigger is broad and can invoke cloud retrieval whenever a user mentions report-related keywords, without strong scoping or confirmation. That raises the risk of exposing historical medical-style records or linking the wrong account context, especially because the skill also describes automatic identity association.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes report-history listing functionality that is outside the stated purpose of analyzing pet eye images/videos. Because this path is tied to an internal identity context and can return prior analysis records, it expands the data-access surface and may expose user-associated history without clear authorization or disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code initializes an internal user identity mechanism even though the advertised function is media analysis. Hidden identity binding increases privacy risk because requests and history operations can be linked to an internal account context without transparent user awareness, and any downstream service may act on that identity implicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script silently resolves a current internal open_id without meaningful user-facing disclosure. In a health-monitoring context involving uploaded pet media and historical reports, hidden identity resolution can enable covert tracking, account linkage, and unintended access to user-scoped data if the surrounding platform populates identity automatically.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2