Fish Fry Growth Rate Measurement (via Reference Object) | 鱼苗生长速度测量（通过参照物）

• Outcome: Review
• Latest audit: Aug 25, 2026 · 11:27 AM UTC
• Version: 1.0.8

Overview

The skill is a fish-growth analysis tool, but it silently creates or reuses user identity, contacts cloud or private API endpoints, and stores tokens locally without enough user control.

Review this skill carefully before installing. It can send fish-tank media and report queries to external services, automatically create or reuse an identity, read a workspace credential file, and keep returned tokens in a local SQLite database. Install only if you trust the publisher, understand the API endpoints being used, and are comfortable with cloud-linked report history and credential persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (25)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 77% confidence
• Finding: This dynamically resolves model attributes from keys in the caller-supplied filters dictionary. Although SQLAlchemy prevents classic SQL injection here, untrusted keys can trigger access to unintended model attributes, cause exceptions, and enable unauthorized filtering over sensitive columns if higher layers pass user-controlled field names through this generic DAO.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 77% confidence
• Finding: As in list(), the count() method accepts arbitrary filter keys and resolves them with getattr() against the model class. If upstream input is user-controlled, this can expose internal schema details, produce denial-of-service through repeated invalid queries, or permit unauthorized probing of sensitive record properties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, local file persistence, and environment-backed identity handling without declaring permissions or clearly constraining those capabilities. That mismatch weakens user and platform oversight, increasing the chance of unexpected data access, local writes, or outbound requests during normal use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is image-based fish growth measurement, but the documented behavior also includes backend account provisioning, token management, local SQLite persistence, and retrieval/listing of historical reports. This description-behavior gap can conceal sensitive identity and data-processing operations from users and reviewers, creating privacy, authorization, and credential-handling risk beyond the expected scope of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exposes a hidden record-listing mode via `--list` and ties it to a resolved internal `open_id`, even though the skill is presented as a fry-growth measurement tool rather than a history retrieval or account-linked data access tool. This creates an undeclared data-access surface that could reveal prior user-linked analysis records and growth reports without clear user disclosure, consent, or visible authorization checks in this file.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code resolves and uses an internal `open_id` through `OpenIdUtil.resolve_current_open_id(...)` despite the skill's declared purpose being image/video growth measurement. Introducing hidden identity handling in a non-account-management workflow expands the privacy and access-control attack surface, especially if identity resolution can bind the current execution to a stored user context without the operator understanding that user-linked data is being accessed.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill accepts arbitrary http/https URLs as input and forwards them for analysis, even though the declared use case is fixed-camera fry measurement from controlled capture workflows. This broadens the trust boundary and can enable misuse such as analyzing untrusted remote content, SSRF-like backend fetch behavior in downstream services, or policy evasion by submitting unrelated external media.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill accepts arbitrary remote URLs and passes them into analysis logic without any visible allowlisting, scheme restriction, or provenance checks. In a fixed-camera fry-tank workflow, this unnecessary network input expands the attack surface and can enable server-side fetching of attacker-controlled content, potentially leading to SSRF-like behavior or processing of untrusted remote media.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This helper exposes generic add/edit/delete plus arbitrary GET/POST/PUT/DELETE wrappers that accept caller-controlled URLs, giving any skill code broad network and state-changing capability unrelated to fry growth measurement. In the context of a narrowly scoped imaging/measurement skill, this materially expands the attack surface and could be abused to access unrelated services, exfiltrate data, or invoke destructive remote actions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Multiple methods forward caller-supplied URLs directly into HTTP requests with no visible restriction, enabling unrestricted remote resource access. This is dangerous because it can be used for SSRF-style access to internal services, data exfiltration to attacker-controlled hosts, or use of the skill as a general-purpose network proxy, none of which are justified by the stated fry-growth analysis purpose.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file defines a generic user-account model and DAO with identity and token-related fields that do not match the stated fry-growth measurement purpose. This kind of capability mismatch increases suspicion because it expands data collection and account handling beyond what the skill needs, creating unnecessary attack surface and privacy risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The model stores token and open_token values in plaintext in a local SQLite database, yet the skill description provides no justification for handling authentication secrets at all. If the database is read by another local component, copied, or exfiltrated, those tokens could enable account compromise or unauthorized API access.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote account provisioning, token management, and authenticated API calls that are unrelated to the declared purpose of fish fry image measurement. This creates an unnecessary data egress and account-coupling channel, and the mismatch between stated purpose and implemented behavior makes the code especially suspicious in this skill context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads identity material from a local file, reuses existing identities, or silently creates a default user identity for later API use. For a fry-growth measurement skill, this is unjustified capability expansion that can bind local activity to external accounts without clear user knowledge or necessity.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The workspace/agent introspection logic discovers agent roots from environment variables and filesystem layout, then creates local data and skills directories. While not directly code execution, it expands the skill's access to host context beyond what is needed for image-based fish measurement and can enable persistence or cross-workspace interference.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger is broad enough to auto-run on generic uploaded fry images or videos, which can cause unintended processing, file saving, and outbound API activity without sufficiently specific user intent. In a skill that also performs local persistence and backend interactions, accidental invocation expands data exposure and operational risk.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Automatically triggering historical report queries on common phrases like viewing reports is risky because it may invoke cloud lookups and return prior records without adequate scoping or confirmation. Since the skill ties reports to internally managed identity, over-broad triggers raise the chance of unintended disclosure of historical analysis data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs internal open-ID resolution without any user-facing warning, help text, or disclosure, which is a privacy and transparency failure. In a tool framed as local or URL-based fry measurement, silently binding execution to an internal identity can surprise users and enable unintended access to user-scoped records or backend actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads the entire local file and uploads it to an analysis service without any disclosure, consent prompt, or visible indication in this execution path. If users believe analysis is local or constrained to metadata, this can cause unintended exfiltration of potentially sensitive media and associated embedded metadata.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: A hidden --api-key argument allows sensitive credential input while suppressing its presence from normal help output, reducing transparency and increasing the chance of unsafe handling. CLI-supplied secrets are often exposed through shell history, process listings, logs, or support transcripts, making this an avoidable credential-leak risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code trusts an environment-derived workspace path and uses it to determine where files and directories will be created, without user disclosure or strong validation. In shared or manipulated runtime environments, this can redirect writes into unintended locations and increase persistence or data-mixing risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill reads a credential-bearing local file containing API-key/open-id material without any explicit disclosure or consent flow. Even if intended for convenience, silent credential consumption is dangerous because it can cause identity reuse and downstream authenticated actions that the user did not knowingly authorize.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically attaches identity and authorization headers and transmits user/account fields over the network without an explicit user-facing warning. In a skill whose stated purpose is local fry measurement analysis, this hidden authenticated communication materially increases privacy, account, and supply-chain risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This code sends a network request to a remote login/provisioning endpoint with identity fields such as openId and mobile, enabling external transmission and possible account creation. That behavior is unrelated to measuring fish fry growth from images, so the skill context makes the transmission more concerning rather than less.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-fish-fry-growth-measurement-analysis"
description: "Through fixed cameras of fry tanks (a known-size reference object such as a scale ruler, standard coin or calibration board must be placed in the view), the system periodically (e.g. daily or weekly) captures fry images and uses AI vision analysis to measure body length (from snout to tail-fin tip, in mm), record individual growth rate (mm/day) and draw the growth curve. | 通过鱼苗缸固定摄像头（需放置已知尺寸的参照物，如刻度尺、标准硬币或标定板），定期（如每天或每周）拍摄鱼苗图像，利用 AI 视觉分析技术测量鱼苗体长（从吻端到尾鳍末端，单位 mm），记录个体的生长速率（mm/天），并绘制生长曲线。系统自动采集图像，生成生长报告，异常时提示（如生长停滞）。"
version: "1.0.11"
license: "MIT-0"
---

• Confidence: 85% confidence
• Finding: The manifest shows metadata-poisoning indicators, including suspicious formatting/content patterns that can interfere with parsing, review, or downstream tool interpretation. In agent skill ecosystems, poisoned metadata can hide capabilities, alter routing, or degrade trust decisions, especially when combined with undeclared shell/network behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2