Fish Fry Growth Rate Measurement (via Reference Object) | 鱼苗生长速度测量（通过参照物）

• Outcome: Review
• Latest audit: Oct 12, 2026 · 1:34 PM UTC
• Version: 1.0.12

Overview

This fish-growth skill matches its stated purpose in part, but it silently provisions a remote identity and stores authentication tokens locally, so it needs review before installation.

Install only if you are comfortable sending fish tank images/videos and identity-linked report requests to the configured LifeEmergence services, and with the skill creating a persistent local user database that may store auth tokens. Review token retention and account creation behavior before using it in shared, regulated, or privacy-sensitive environments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The implementation reportedly performs authenticated outbound API access, automatic user/open-id creation, local workspace discovery, token/header injection, and possible account registration/login, none of which are clearly disclosed by the benign fish-measurement description. In this context, concealed identity creation and tokenized remote access are especially dangerous because they enable tracking and external data exchange under misleading pretenses.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-fish-fry-growth-measurement-analysis"
description: "Through fixed cameras of fry tanks (a known-size reference object such as a scale ruler, standard coin or calibration board must be placed in the view), the system periodically (e.g. daily or weekly) captures fry images and uses AI vision analysis to measure body length (from snout to tail-fin tip, in mm), record individual growth rate (mm/day) and draw the growth curve. | 通过鱼苗缸固定摄像头（需放置已知尺寸的参照物，如刻度尺、标准硬币或标定板），定期（如每天或每周）拍摄鱼苗图像，利用 AI 视觉分析技术测量鱼苗体�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script behavior does not match the skill manifest: instead of performing fry image growth measurement, it exposes a generic video-analysis pathway and history-listing functionality. This kind of capability mismatch is dangerous because it can mislead reviewers and users about what data is processed, what backend actions occur, and whether unrelated or broader media-analysis features are being invoked under a narrower declared purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI help text and user-facing descriptions present this as a generic video analysis tool, directly contradicting the manifest's claimed fry-growth measurement purpose. Such misleading documentation increases the risk of unauthorized or unexpected use, weakens security review, and can conceal broader collection or processing of user media than users consented to.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The model stores authentication-like tokens plus personal profile fields including real name, email, birthday, sex, and age, none of which are justified by a fish fry growth-measurement function. Collecting and storing this data expands the blast radius of compromise, creates unnecessary privacy/compliance exposure, and may enable credential or session abuse if tokens are readable elsewhere in the system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility file contains broad identity provisioning, token management, remote login, and API request capabilities that are unrelated to the declared fish fry growth measurement purpose. Such hidden cross-cutting functionality expands the attack surface, enables undisclosed account linkage and network activity, and is especially suspicious because the skill’s manifest does not justify remote user/account lifecycle operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code automatically derives or creates a persistent open-id, including generating default usernames and storing them for later reuse. For a fish growth measurement skill, silently creating platform identities is unnecessary and dangerous because it can bind a user or workspace to remote services without informed consent and create long-lived identifiers for tracking or abuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and instructs use of shell, local file, environment, and network-capable behavior but does not declare an explicit tool/permission scope. That creates an overprivileged integration pattern where a caller may grant broader capabilities than users or reviewers expect, increasing the risk of unintended file access, command execution, or remote data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that uploaded attachments are automatically saved as local files but does not clearly warn users about local storage, retention, or location. For image/video inputs, this can create unanticipated privacy and disk-residency risks, especially in shared or regulated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes automatic cloud API queries for historical reports without a clear warning that user-linked data will be transmitted to a remote service. This lack of disclosure undermines informed consent and may violate organizational or regulatory data-transfer requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该文档从标题开始即以中文固定呈现，且全文未说明是否支持其他语言，也未提供用户语言选择或显式的区域适用范围。根据规则，强制特定语言而无用户选择或明确、合理的区域限定，属于自然语言层面的语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code resolves an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) even though the --open-id parameter is hidden from help output and the comment explicitly states the identity initialization is not shown to users. This creates undisclosed identity access and potential silent attribution of actions or history queries to a user account, which is a privacy and auditability concern.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2