Fish Abnormal Swimming Posture (Side-swim / Upside-down) Detection | 鱼类游动姿态异常（侧游/倒立）识别

• Outcome: Review
• Latest audit: Sep 30, 2026 · 4:52 AM UTC
• Version: 1.0.11

Overview

This skill appears to be a real fish-video analysis client, but it silently creates or reuses an identity, persists tokens locally, uploads media to a cloud service, and can automatically query cloud history.

Review this skill before installing. It is suitable only if you are comfortable sending fish videos or video URLs to LifeEmergence cloud services and allowing the skill to silently create or reuse a local/cloud identity, persist tokens in the workspace data directory, and retrieve cloud-stored history reports for that identity. Avoid using it with sensitive camera footage unless you understand the service and retention terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of external HTTP communication, authentication/token management, automatic user creation/login, filesystem access, environment detection, and persistence is far broader than the declared fish-posture analysis task. In context, that makes the skill more dangerous because it handles identity and remote services while being framed as a simple health-monitoring analyzer, raising risks of silent account linkage, data exfiltration, and over-collection.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-fish-abnormal-swimming-detection-analysis"
description: "Through fixed cameras on aquariums, the system analyzes fish swimming videos and computes the angle between the fish body axis and the horizontal plane (normal fish bodies stay nearly horizontal). | 通过鱼缸固定摄像头，分析鱼类的游动视频，检测鱼体轴线与水平面的夹角（正常鱼体基本保持水平），当鱼体倾斜角度超过阈值（默认 > 30°）或出现倒立（头部向下 > 45°）、旋转（绕自身纵轴连续翻转）等异常游姿时，标记为异常，并记录异常时长占观察总时长的比例。该技能有助于早期�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This utility file provisions user identities, performs login/registration flows, persists tokens, and injects authentication data into outbound API requests, which is unrelated to the stated fish-swimming video analysis purpose. In a skill that should analyze aquarium video, hidden account bootstrap and token persistence materially increase the chance of undisclosed data transmission, account misuse, and user confusion about what external services are being contacted.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares broad operational behavior including shell execution, network access, local file handling, and implicit identity handling, but it does not declare any explicit tool or permission scope. This creates a capability-transparency gap: reviewers and runtime policy systems cannot easily constrain what the skill is allowed to do, increasing the chance of over-privileged execution or unintended data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The default trigger condition is broad enough that merely providing a fish-related video URL or file can automatically activate the skill. Overbroad activation is risky because it can cause unintended execution, remote uploads, or data processing without clear user intent, especially in an agent system where files may be shared for other purposes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The history-report keywords automatically trigger a cloud lookup with little scope limitation, which can retrieve identity-linked records based on broad phrasing. This raises privacy and authorization concerns because a casual or ambiguous request may invoke remote history access beyond what the user intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script exposes a history-listing function that retrieves prior analysis records via skill.get_output_analysis_list(open_id=open_id), which is outside the stated single-video analysis purpose. Hidden or undocumented data-access features increase the risk of unintended information disclosure, especially when combined with internal identity resolution elsewhere in the script.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script initializes and uses an internal user identity (OpenIdUtil.resolve_current_open_id) even though fish-video posture analysis does not require account-context to process a file or URL. This creates an unnecessary identity/data linkage surface and, when paired with the listing feature, could expose another user's historical analysis data or enable silent collection of user identifiers.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes analyzing fish swimming videos captured through fixed aquarium cameras, which implies processing provided camera footage rather than fetching arbitrary remote media by URL. The code explicitly supports HTTP/HTTPS input and forwards it as videoUrl, expanding the skill from local video analysis to remote URL ingestion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill accepts either a remote video URL or reads a local file into memory and passes it to self.analysis(...), which indicates network transmission of user data for analysis. In this file there is no confirmation prompt, print/log disclosure, or comment/docstring warning users that local file contents or supplied URLs will be sent to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest focuses on detecting abnormal fish swimming posture and computing abnormal-duration ratios. This file also implements retrieval of historical analysis report lists and export-image URLs, which are broader report-management features not described in the stated skill purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a video analysis tool, but the CLI also exposes retrieval of per-user analysis history via --list and hidden --open-id handling. This expands the data access surface beyond the advertised purpose and can enable unauthorized enumeration or disclosure of historical analysis records if identity binding and authorization are weak elsewhere in the stack.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file exposes a generic API wrapper with broad CRUD and arbitrary request methods that are not constrained to the stated fish-swimming analysis purpose. In an agent-skill context, this expands the capability surface substantially and could let the skill interact with unrelated internal or external services, enabling data exfiltration or unauthorized actions if other parts of the skill can influence URLs or payloads.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2