Back to skill

Security audit

Fish Abnormal Swimming Posture (Side-swim / Upside-down) Detection | 鱼类游动姿态异常(侧游/倒立)识别

Security checks across malware telemetry and agentic risk

Overview

The skill does fish-video analysis, but it also automatically binds identity, uploads media to a backend, queries cloud history, and stores account tokens locally with weak user control.

Review before installing. Use it only if you are comfortable with aquarium media being sent to a backend service, reports being associated with an automatically selected identity, and account tokens being stored in a local workspace database. The default private dev endpoint configuration should be corrected or explained before normal use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no permissions while its documented behavior and referenced scripts imply access to environment data, local files, network resources, shell execution, and local persistence. This mismatch is dangerous because it prevents informed review and sandboxing, and can let a seemingly simple video-analysis skill perform broader actions than users or orchestrators expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The stated purpose is fish posture analysis, but the skill also documents identity resolution, persistent local user storage, backend token acquisition, cloud history access, and report-link generation. This is dangerous because hidden account, storage, and remote-access behavior expands the trust boundary far beyond image analysis and can expose user data or enable unauthorized backend interaction under the guise of a benign domain-specific tool.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The documentation broadens the skill from posture analysis into cloud history retrieval, report-link lookup, and app-alert workflows not reflected in the top-level description. This scope creep is risky because operators may authorize the skill for passive analysis while it actually performs additional data-access and notification functions.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The documented workflow says uploaded media is automatically saved locally and that persistent daily reports are generated, which exceeds an analytics-only description. This matters because local retention and report persistence introduce privacy, storage, and forensic risks that are not clearly disclosed in the manifest.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is presented as a fish-video analysis tool, but it also exposes a history-listing capability tied to a user identity via `show_analyze_list(open_id)` and the `--list` flow. This creates an unexpected data-access surface unrelated to the primary stated function, increasing the risk of privacy leakage or unauthorized access to prior analysis records if identity resolution or authorization is weak elsewhere.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code initializes internal user identity with `OpenIdUtil.resolve_current_open_id(...)` even for a fish-video analysis workflow that does not obviously require identity to analyze a local file or URL. Hidden identity binding expands the privacy and access-control surface, and if misused can associate analyses with users or enable access to user-scoped data without clear user consent or manifest justification.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary HTTP(S) video URLs, which expands behavior beyond the declared fixed-camera aquarium analysis scope and creates an unintended network-fetch capability. This can be abused to process untrusted remote content, trigger access to attacker-controlled resources, and potentially enable SSRF-like behavior in downstream services if the backend fetches the provided URL.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The skill exposes report listing and export-link generation functionality that is outside the stated anomaly-detection purpose, increasing the accessible data surface. If access control is weak in surrounding components, this could enable unauthorized discovery of prior analyses or retrieval of report artifacts containing sensitive user data.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The script resolves a hidden OpenID context and then uses a current identity for the `--list` flow, even though the advertised function is local fish-video analysis. This creates an unnecessary identity-binding and history-access surface that could expose another user's analysis history or enable silent user tracking if identity resolution is implicit or insufficiently consented.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file exposes generic CRUD helpers and arbitrary HTTP methods that can send requests to caller-supplied URLs, which is substantially broader than the stated fish-swimming analysis purpose. In a skill that should perform narrow video analysis, this creates an unexpected capability for remote interaction, data exfiltration, or invoking unrelated external services if other components pass untrusted inputs into these wrappers.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The http_post/http_put/http_get/http_delete methods provide a generic outbound HTTP client interface unrelated to the declared aquarium video-analysis function. That mismatch increases risk because the skill can be repurposed to contact arbitrary remote systems, enabling unauthorized data transfer or command-and-control-like behavior if abused by surrounding code.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The file defines a generic user-account DAO and user model, including identity-oriented fields, despite the skill being described as aquarium fish abnormal-swimming detection. This is a scope mismatch that expands the skill's access to personal/account data and suggests hidden or unnecessary capability beyond the manifest, increasing privacy and supply-chain risk.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The module creates and manages a local SQLite database with broad CRUD behavior that is not described in the fish-swimming analysis manifest. Undisclosed persistence increases data-retention, privacy, and post-compromise impact, especially when a vision-analysis skill should not need a generic shared database layer by default.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores token and open_token fields even though authentication data is unrelated to abnormal fish-swimming detection. Retaining credential-like secrets in a local shared SQLite database materially increases the impact of data exposure, local compromise, or misuse by other components, and the skill context makes this especially suspicious because there is no clear functional justification.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility module performs remote login/registration, token retrieval, token persistence, and authenticated HTTP request handling that are unrelated to fish-swimming video analysis. In the context of a narrowly described aquarium analytics skill, hidden identity bootstrapping and outbound authenticated communications create a strong risk of covert account use, data exfiltration, or unauthorized service consumption.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The code silently creates and persists synthetic user identities when no current identity exists, including generating usernames and writing them into a local database for later reuse. For a fish behavior analysis skill, this is unjustified functionality that can impersonate users, mask accountability, and enable undisclosed remote service access under fabricated identities.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill contains logic to discover agent workspaces and create writable data and skills directories, which exceeds the stated need of analyzing fish swimming posture from video. Such environment discovery and writable path management increase the attack surface by enabling broader file-system awareness and potential persistence or cross-skill interference.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads a local credential-like file and interacts with a local user database to recover and reuse identity information beyond what is necessary for video analytics. In this skill context, harvesting local identifiers and maintaining user records is suspicious and creates privacy and credential-handling risks.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The default trigger is broad enough to invoke the skill whenever an aquarium video is supplied, even if the user did not intend health monitoring or cloud processing. Overbroad triggering is dangerous because it can cause unexpected file handling, remote uploads, identity association, or report generation without sufficiently specific user consent.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The auto-trigger keywords for historical report lookup are broad and lack guardrails, which can initiate cloud history retrieval from casual phrasing. In this skill, that is more dangerous because history retrieval is tied to internal identity association and remote API access, increasing the chance of unintended disclosure of prior records.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The hidden `--open-id` parameter and automatic current-user identity resolution access internal identity without clear disclosure in the user-facing interface. This is dangerous because it obscures privacy-relevant behavior and may enable unintended collection, association, or retrieval of user-linked records, especially in a tool whose advertised purpose is just fish posture analysis.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The code reads the entire local file and uploads it for analysis without any visible disclosure, confirmation, or privacy notice in this file. For user-provided videos, this creates a data-transfer risk because potentially sensitive media is sent to an external analysis service without transparent consent at the point of action.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code reads a sensitive identity value from data/smyx-api-key.txt without any visible user-facing notice or consent flow. Silent consumption of local key material is dangerous because it can appropriate existing credentials or identifiers for unrelated network actions without the operator understanding that the fish-analysis skill is doing so.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2