Back to skill

Security audit

Fish Isolation / Schooling Behavior Detection | 鱼类聚集/离群行为识别

Security checks across malware telemetry and agentic risk

Overview

The skill does fish-video analysis, but it also silently manages cloud identity, local token storage, and broad network helpers that users should review before installing.

Install only if you are comfortable sending aquarium videos or video URLs to the LifeEmergence cloud service and allowing the skill to create/reuse a local identity, query cloud report history, and store service tokens in the workspace data directory. Review the local data directory and token retention expectations before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises no explicit permissions, yet its instructions and referenced scripts imply access to environment data, local files, network endpoints, and shell execution. This creates a capability transparency problem: operators and users may approve a seemingly simple fish-analysis skill without realizing it can save files locally, invoke Python modules, and contact remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow behavioral analysis of fish videos, but the skill also describes identity bootstrapping, token retrieval, cloud history access, and local persistence of user identifiers. That mismatch is dangerous because it conceals data collection and account-related operations behind an innocuous analytics use case, increasing the risk of unauthorized tracking, privacy violations, and user confusion.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is described as a fish-isolation video analysis tool, but it also exposes a history-listing function tied to a user identity via `open_id`. This creates a scope mismatch: a caller may gain access to historical analysis data unrelated to the immediate video-processing task, increasing the risk of unintended data exposure or cross-user information access if identity handling is weak.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code resolves an internal user identity with `OpenIdUtil.resolve_current_open_id(...)` even though the advertised function is only fish video analysis. Introducing hidden identity resolution expands the data-handling surface and may enable user tracking or unauthorized retrieval of user-linked records, especially because `--open-id` is suppressed from help and the identity use is not transparent to operators.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, which expands behavior beyond the declared fixed-camera aquarium tracking use case. This can enable misuse of the skill as a generic remote video ingestion proxy and may cause analysis of unintended or sensitive third-party content without clear scope restriction.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The code exposes report listing and export-link generation features that are not described in the manifest's fish-isolation-detection purpose. Undocumented data access surfaces increase the attack surface and may allow users or integrators to retrieve prior analysis artifacts beyond the expected single-analysis workflow.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
Report management capabilities are unrelated to the narrowly described fish isolation detection function, indicating scope creep in the skill implementation. Extra retrieval/export functionality can expose stored analysis metadata or images and creates additional paths for unauthorized access if backend controls are weak.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The script exposes a `--list` path that retrieves analysis history via `skill.get_output_analysis_list(open_id=open_id)`, but this capability is not reflected in the stated fish-isolation detection functionality. Undisclosed data-listing behavior increases the attack surface and can enable unauthorized enumeration of prior analyses or user-associated records if access control around `open_id` is weak elsewhere.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file exposes generic add/edit/delete and arbitrary HTTP verb wrappers that can send requests to caller-supplied URLs, which materially exceeds the manifest's narrowly described fish-isolation detection purpose. In a skill ecosystem, this creates a reusable network primitive that can be abused for unauthorized data exfiltration, lateral interaction with internal services, or triggering remote side effects unrelated to aquarium analysis.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The http_post/http_put/http_get/http_delete methods provide arbitrary outbound request capability with no visible restriction on destination, method, or payload. Given the declared skill function only involves camera-based fish tracking and thresholding, this unjustified network surface is suspicious and dangerous because it can be repurposed as a generic proxy for exfiltration or access to unintended services.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill claims to perform fish-isolation analytics, but this module defines a sys_user table storing usernames, email addresses, tokens, and open tokens. That is a scope mismatch and expands the attack surface with credential-like data handling unrelated to the declared function, increasing privacy and secret-exposure risk if the skill is installed in a broader agent environment.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This file implements broad local database creation, schema migration, and generic CRUD operations that go well beyond the manifest's described camera-based analytics and alerting behavior. In a skill ecosystem, hidden persistence and generalized data management are dangerous because they can enable stealthy collection, retention, or repurposing of unrelated local data.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This section provisions and persists API-linked identities/open IDs unrelated to the stated fish-isolation detection function. In the context of a narrowly scoped aquarium-analysis skill, hidden identity creation and persistence expands capabilities far beyond declared behavior and can enable unauthorized account binding, tracking, or use of external services under implicit identities.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file implements a generalized HTTP client with token handling, retry logic, and arbitrary remote API access, which is not justified by the manifest’s simple camera-based fish behavior analysis. Such broad network capability increases the risk of undisclosed data exfiltration, remote command-and-control style integration, and misuse of local identity material.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill detects workspace context from environment/filesystem state and reads data/smyx-api-key.txt, despite no obvious need for workspace credential discovery in fish-isolation analysis. Accessing ambient credentials and agent workspace information without clear disclosure broadens access to sensitive local context and can facilitate later outbound authentication or correlation.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code auto-registers/logs in users against a remote service and persists returned user records and tokens locally. For a fish-monitoring skill, that behavior is context-inappropriate and dangerous because it silently creates external accounts, links local identifiers, and stores authentication artifacts that may be reused later.

Vague Triggers

Medium
Confidence
88% confidence
Finding
A default trigger that fires on essentially any uploaded aquarium video is overly broad and can cause unintended activation. In practice this can lead to surprise processing, automatic data handling, or unnecessary transmission/storage of user media without sufficiently specific intent from the user.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The keyword triggers include broad behavioral phrases that may match ordinary conversation without clear consent boundaries. This raises the chance of accidental invocation and downstream handling of files, cloud queries, or analysis actions the user did not explicitly request.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill says uploaded attachments are automatically saved as local files but does not present that as a prominent user warning in the description. Silent local persistence of user media is a privacy and retention risk, especially for continuous video feeds that may contain more information than users expect to be stored.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill reads arbitrary local file contents into memory and uploads them for analysis without any visible consent, warning, or contextual restriction in this code. This creates a privacy and data-handling risk because users may inadvertently transmit sensitive local videos or files to a remote service under a narrowly described aquarium-analysis label.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script accepts a hidden `--api-key` argument suppressed from help output, which conceals credential handling from users and reviewers. Hidden secret-bearing parameters reduce transparency, complicate secure operational review, and can lead to accidental credential exposure through shell history, process listings, wrappers, or undisclosed downstream use.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code automatically creates local data/skills directories for the current agent workspace, enabling undisclosed persistence on disk. In combination with the broader identity/token logic in this file, silent directory creation makes covert state retention easier and is more concerning than ordinary local caching.

Missing User Warnings

High
Confidence
97% confidence
Finding
The HTTP helper automatically injects user identity, API keys, access tokens, tenant, and platform metadata into outbound requests without any user-facing disclosure. This creates a strong risk of silent credential transmission and data leakage, especially because the helper is generic and can send to arbitrary absolute URLs as well as base-URL-relative endpoints.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2