Ornamental Fish Color Brightness Assessment | 观赏鱼体色鲜艳度评估

• Outcome: Review
• Latest audit: Oct 14, 2026 · 6:16 PM UTC
• Version: 1.0.13

Overview

The skill is a cloud-backed fish-image analyzer, but it automatically creates or reuses a hidden account, stores access tokens locally, uploads media, and can fetch remote report history with limited user-facing control.

Install only if you are comfortable sending fish images or videos and report queries to the LifeEmergence remote service. Treat its history feature as account-linked, and review or delete the workspace data database/tokens if you do not want persistent identity reuse.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s description promises fish-specific HSV analysis, scoring, and health-oriented logic, but the observed behavior appears to be generic API orchestration, identity initialization, persistence, and report retrieval. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions based on a benign domain-specific description while the actual implementation performs broader remote and local operations that are not transparently disclosed.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

A metadata-poisoning indicator in the manifest is concerning because poisoned or malformed manifest fields can manipulate tool parsing, policy enforcement, or downstream orchestration logic. In this skill, that risk is amplified by already-broad behavior involving remote APIs, local storage, and command execution instructions, making manifest integrity especially important.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-fish-color-brightness-assessment-analysis"
description: "Through fixed aquarium cameras, the system periodically captures high-definition side images of ornamental fish (such as koi, goldfish, tropical fish), and uses AI vision analysis to extract color saturation (HSV-S channel) and brightness (HSV-V channel) of specific body regions (e.g. mid-trunk), compares them with healthy standard color ranges of the same species (built-in database or user-defined), and outputs a vibrancy. | 通过鱼缸固定摄像头，定期拍摄观赏鱼（如锦鲤、金鱼、热带鱼）的体侧高清图像，利用 AI 视觉分析技术提取鱼体特�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest claims the skill captures side images of ornamental fish, extracts HSV saturation/brightness from specific body regions, compares against healthy species ranges, and outputs a 0-100 vibrancy score with low-score alerts. This code instead accepts a local or remote video path, uploads or forwards it for generic analysis, polls for a backend report, and exposes report listing/export URLs, with no fish-specific logic, HSV processing, region analysis, species standards, scoring, or threshold alert behavior present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code behavior materially diverges from the manifest: instead of fish image color/brightness assessment, it performs generic video analysis and history listing through an external skill backend. This is dangerous because users and reviewers may grant the skill access based on a benign, narrow aquarium-monitoring description while the implementation processes broader media inputs and potentially different data flows than disclosed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file implements a generic user-account DAO with identity and token handling, which does not align with the stated fish color/brightness assessment purpose. Capability mismatch is a strong indicator of over-privileged or repurposable code; if this skill is installed in a limited-trust environment, it expands the attack surface to account persistence and credential-related data handling unrelated to fish-image analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The model stores user identity data and authentication-like secrets (token, open_token) despite the skill being described as aquarium fish image assessment. Collecting and persisting such data without a clear functional need creates unnecessary confidentiality risk, and compromise of the local SQLite database would expose sensitive credentials or identifiers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility code performs remote account creation/login, token acquisition, and persistence of credentials, which is unrelated to the stated fish color/brightness assessment purpose. Such hidden identity provisioning materially expands the skill's privileges and enables undisclosed outbound communication and account linkage, making the mismatch highly suspicious in this context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares broad operational behavior including shell execution, network access, local file handling, and environment use, but does not scope or constrain those capabilities in metadata. This increases the chance of over-privileged execution and makes it harder for a host system or reviewer to enforce least privilege, especially because the document explicitly instructs command execution and cloud access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The default trigger is broad enough to activate on many generic fish image or video analysis requests, which can cause unintended invocation of a skill that performs local saving and remote API submission. Over-broad auto-routing increases the risk of sending user media and linked account data to the wrong workflow without clear consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The history-report trigger phrases are loosely defined and may auto-run cloud queries whenever a user mentions historical reports in general terms. Because these queries are tied to internal identity and remote data retrieval, ambiguous activation can expose user-linked records unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill states that uploaded attachments or media are automatically saved locally, but does not present a clear inline warning or consent boundary where that behavior is introduced. Automatic persistence of user media increases privacy and retention risk, especially for images and videos that may contain sensitive environmental or account-linked information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill automatically queries a cloud API for historical reports linked to an internal identity without a clear upfront disclosure at the point of use. This is risky because users may not realize that their request causes remote retrieval of account-scoped data and associated metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script exposes a history-listing capability keyed by internal user identity (open_id) that is not part of the stated fish image-analysis/scoring purpose. This creates unnecessary access to potentially sensitive historical analysis data and can enable unauthorized enumeration or retrieval of prior records if identity handling elsewhere is weak or bypassable.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2