Ornamental Fish Color Brightness Assessment | 观赏鱼体色鲜艳度评估

• Outcome: Review
• Latest audit: Aug 25, 2026 · 9:13 AM UTC
• Version: 1.0.9

Overview

This aquarium analysis skill is cloud-backed and documented in part, but it silently creates or reuses an identity, stores service tokens locally, and uses broad file/URL/network behavior that needs review before installation.

Review this before installing. Use it only if you are comfortable sending fish images/videos and report-history requests to the publisher's service, allowing a local workspace database with generated identity and service tokens, and accepting arbitrary URL submission to the backend. Ask the publisher to provide production endpoint configuration, explicit permission declarations, URL allowlisting, token-storage documentation, and a way to inspect/delete stored identity data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no explicit permissions, yet its content and referenced behavior indicate environment access, local file read/write, network access, and shell execution. That mismatch deprives users and host systems of informed consent and proper sandboxing, increasing the chance that sensitive files, tokens, or shell commands are used without appropriate review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to perform local aquarium-image analysis, but the described behavior includes persistent identity creation, token storage, remote login-style flows, cloud history access, and backend delegation of the actual analysis. This is dangerous because users may provide media believing it is processed as described, while undisclosed account linkage and remote processing can expose personal data, media, and activity history beyond the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill accepts video inputs and remote video URLs even though the manifest describes fixed-camera image-based fish color/brightness assessment. This mismatch broadens the capability surface beyond the declared purpose and can enable unintended data exfiltration or misuse of the backend analysis service with off-scope media.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code implements a generic file/URL upload-and-analyze workflow rather than fish-specific color/brightness logic. Because it reads arbitrary local files and forwards them to an analysis API, the skill can be used as a general-purpose content submission mechanism unrelated to its stated function, increasing the risk of unauthorized data transfer.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill permits arbitrary http/https URLs to be supplied as analysis input, which is not justified by a fixed-aquarium-camera capture use case. Allowing unrestricted remote URLs can expose internal or sensitive network resources to the downstream service and creates an SSRF-like risk path or a covert way to submit external content for processing.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The implementation materially diverges from the declared fish color/brightness assessment behavior and instead exposes a generic video-analysis entrypoint. This kind of scope mismatch is dangerous because it can hide undeclared capabilities from reviewers and operators, causing the skill to process broader content or invoke backend behaviors that were never approved for this use case.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: Support for remote URL ingestion and history listing is not justified by the manifest's narrow fixed-camera image-analysis description, which increases the exposed attack surface. Remote URLs can enable server-side fetching of arbitrary resources, and history listing can expose prior analysis metadata or user activity outside the expected scope.

Intent-Code Divergence

Medium

• Confidence: 75% confidence
• Finding: The function signature and docstring imply API-mediated analysis with configurable API parameters, but the implementation ignores those controls and directly forwards the path/URL to the skill object. This discrepancy undermines operator expectations and can bypass intended routing, authentication, or auditing controls tied to the documented API settings.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: Advertising the tool as a generic video-analysis CLI conflicts with the manifest's specific fish color/brightness assessment purpose. In security review terms, misleading labeling is risky because it obscures the true operational scope and can normalize use on arbitrary media beyond the approved domain.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This file exposes broad generic API capabilities including arbitrary URL-based GET/POST/PUT/DELETE methods and CRUD-style wrappers that are not constrained to the stated fish color/brightness assessment purpose. In an agent-skill context, such unrestricted network primitives can be repurposed to access unrelated internal or external services, increasing the risk of unauthorized data access, SSRF-style behavior, or hidden capability expansion beyond the declared function.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The implementation is a reusable remote API service layer rather than code specific to fish-image analysis, which indicates substantial capability mismatch with the skill description. In a security review, this matters because generalized transport layers can conceal undeclared behaviors and enable other components of the skill to perform arbitrary network operations unrelated to the user-visible purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file implements persistent user-account storage, including a reusable User/UserDao abstraction, even though the stated skill is fish color/brightness assessment. This kind of unrelated identity data handling expands the attack surface and enables collection or retention of personal/account data without a clear functional need, which is especially suspicious in a narrowly scoped vision-analysis skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores authentication-like secrets (token, open_token) along with personal profile fields such as real name, email, birthday, sex, and age, none of which are justified by the fish assessment function. If this database is accessed, leaked, or reused across skills, it could expose sensitive personal and authentication data well beyond what users would expect from an aquarium image-analysis skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This utility file includes broad remote API, token, and account-management behavior that is not justified by a fish color/brightness scoring skill. Such hidden network and identity logic materially expands the attack surface and can cause undisclosed data transmission, account linkage, and unexpected remote side effects during normal skill use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads a workspace identity file and, if absent, creates a persistent default user identity in local storage. For a fish-image vibrancy assessment skill this is unnecessary identity persistence, and it can silently bind user activity to a generated or recovered identifier without informed consent.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The code performs silent auto-registration/login against an external health service using generated or recovered identifiers, which is completely unrelated to the advertised fish-analysis purpose. This creates remote accounts and transmits identity data without user awareness, making the behavior highly deceptive and potentially enabling tracking, unauthorized account creation, and misuse of external services.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The default trigger is broad enough to invoke the skill whenever a user provides aquarium images or videos for analysis, without tighter confirmation that they want this specific cloud-backed workflow. Overbroad auto-invocation can cause unintended file handling, local saving, API calls, and identity-linked processing on content the user did not mean to submit to this skill.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The automatic history-report trigger keywords are generic enough that normal requests to view reports could silently initiate cloud API queries tied to an internal identity. This creates privacy risk because historical records may be fetched and displayed without a clear, fresh consent boundary or sufficient scope validation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that uploaded attachments are automatically saved as local files, but does not present that as a clear user-facing warning in the description or consent flow. Silent local persistence of user media increases the risk of privacy leakage, unintended retention, and later access by other tools or users on the same system.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill automatically queries a cloud API for historical reports, but the description does not provide a clear privacy warning that user-associated report metadata and possibly media-derived records are accessed remotely. Hidden cloud access can expose behavioral history and identifiers in ways users do not reasonably expect from the headline description.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script resolves an internal user identity through OpenIdUtil.resolve_current_open_id() while suppressing the open-id argument from normal help output and without a clear user-facing notice. Hidden identity collection or linkage can undermine privacy expectations, enable silent attribution of analysis activity to a user account, and increase the risk of unintended tracking or cross-request correlation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill reads full local file contents and submits them to the analysis service without any visible disclosure, confirmation, or contextual warning in this code path. In practice, this can lead users or integrators to send sensitive local media or unrelated files off-host without clear awareness, especially because the implementation is broader than the manifest suggests.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The DAO initializes a writable SQLite database and creates tables automatically on startup without any disclosure or consent flow. In the context of a fish-appearance analysis skill, silent persistent storage is risky because users may reasonably expect ephemeral image scoring rather than hidden local account/data retention.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Automatic schema migration via ALTER TABLE modifies the local database structure without notice and specifically prepares user-profile fields in sys_user. Silent schema evolution increases persistence and data collection capability over time, which is more concerning because the skill's stated purpose does not require user-account management.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debugging are turned on globally, which can expose request URLs, headers, payloads, and responses in logs. Because this module also handles tokens and identity-related traffic, debug output may leak sensitive data into local logs or consoles without clear user disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2