Back to skill

Security audit

Fish Respiratory Rate (Gill Opening / Closing) Monitor | 鱼类呼吸频率(鳃盖开合)监测

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised fish-video analysis, but it also silently uses cloud services, account identity, history lookup, and local token persistence in ways users should review before installing.

Install only if you are comfortable with fish videos or video URLs being sent to the publisher's cloud service, cloud history being queried by account identity, and local workspace storage of generated user records and service tokens. Prefer a version that asks before uploads/history lookups, documents identity and retention behavior, and avoids storing raw tokens locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, network access, and implicit identity initialization, yet declares no permissions or trust boundaries. This creates a capability mismatch where a caller may invoke a skill expecting passive analysis, but the skill can perform side effects such as saving files, contacting remote APIs, and reading or writing local state.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill metadata presents this tool as a simple fish respiratory-rate analyzer, but the CLI also exposes a history-listing function that retrieves prior analysis records by internal identity. This creates an unnecessary data-access surface not implied by the declared purpose, increasing the risk of unauthorized access to stored analysis history or user-associated data.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code initializes and uses an internal open_id even for a tool whose stated purpose is only video analysis, then uses that identity for history access. Tying analysis behavior to hidden identity resolution can enable unintended data association or retrieval of user-specific records without clear user awareness, which is a privacy and access-control concern.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary http/https video URLs and forwards them to the backend analysis service without constraining origin, domain, or the manifest-described fixed-camera aquarium workflow. This expands the capability beyond the declared purpose and can be abused to submit unexpected external content, potentially triggering backend-side SSRF-like fetching, policy bypass, or unintended processing of non-aquarium media.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script includes a `--list` path that calls `skill.get_output_analysis_list(open_id=open_id)` to enumerate historical analysis records, which is outside the stated respiratory-rate video analysis purpose. This expands the skill from single-item analysis into account-scoped data access, creating an unnecessary privacy and authorization risk if history can be retrieved for a resolved or injected identity.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code resolves and uses `open_id` via `OpenIdUtil.resolve_current_open_id(...)` and `ConstantEnum.CURRENT__OPEN_ID`, even though the skill description only describes local or URL-based fish respiratory video analysis. Undisclosed identity handling increases the attack surface for tracking, cross-user data access, and privacy violations, especially when paired with the history-listing feature.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This shared config code reads platform/user identity environment variables such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID even though they are unrelated to fish respiratory-rate analysis. Unnecessary collection of identity-linked data expands the skill's access scope and creates privacy and data-minimization risks if those values are later logged, transmitted, or reused by downstream components.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The config exposes a broad set of integration placeholders including API keys, secret keys, database URLs, tokens, and multiple external service base URLs that exceed the declared scope of a fish respiration monitoring skill. Even if not directly exploited in this file, this overbroad shared surface increases the chance of accidental secret use, privilege creep, or unsafe coupling to unrelated systems.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file defines a generic user DAO and persists account-like fields including username, realname, email, token, and open_token, which are unrelated to fish respiratory-rate analysis. In this skill context, collecting and mutating identity and token data is unjustified and increases the risk of credential exposure, privacy violations, and covert cross-skill persistence.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The model explicitly manages personal/account records and authentication-like token fields without any visible relation to aquarium video respiratory monitoring. In a narrow-purpose analysis skill, this data handling is suspicious and materially raises the blast radius if the local database is read, copied, or shared across agent workspaces.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility performs broad remote API interaction, identity bootstrapping, token handling, and account-linked operations that are unrelated to aquarium fish respiratory-rate monitoring. The mismatch between declared skill purpose and implemented capabilities increases the chance of unnecessary data exfiltration, hidden account activity, and abuse of the host agent environment.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code automatically derives or creates user identities, persists them locally, and stores authentication material for later reuse without a clear need for fish respiration analysis. Auto-provisioning identities and silently persisting tokens can bind users to remote services they did not knowingly authorize and create durable compromise if the workspace is accessed by others.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Embedding recharge and payment workflow messaging inside a fish-monitoring utility is unjustified functionality and indicates coupling to monetized remote services beyond the declared purpose. While not directly exploitable by itself, it signals hidden service dependencies and can mislead users into performing account/payment actions unrelated to local analysis.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default trigger activates whenever a qualifying video URL or file is provided, which is broader than necessary for a specialized medical-style aquarium analysis skill. Overbroad auto-invocation can cause the agent to route unrelated user content into this skill and trigger file saving or remote API use without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The keyword list includes common problem-description terms like hypoxia, gasping, and oxygen pump references, which can appear in ordinary discussion rather than a request to execute the skill. This ambiguity increases the chance of unintended activation and downstream network or file operations on user-provided media.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill says historical report queries should be auto-triggered from broad phrasing and must directly call a cloud API. That can convert ordinary requests about prior reports into external data retrieval, increasing privacy and data exposure risk, especially because the skill also describes automatic internal identity association.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code reads local file contents or passes remote video references to an external analysis API without any user-facing disclosure, consent step, or visible indication that content is being transmitted off-device. This creates a privacy and data-handling risk, especially if uploaded videos contain sensitive environmental, household, or user-identifying information.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
Sensitive environment variables are accessed implicitly with no user-facing disclosure, consent boundary, or visible need tied to the stated aquarium monitoring function. In a narrowly scoped computer-vision skill, silent identity/env access is more suspicious because it enables hidden context collection beyond what users would reasonably expect.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Enabling HTTPConnection and urllib3 debug logging can expose request URLs, headers, bodies, and responses, which may include tokens, open IDs, usernames, or other sensitive operational data. In shared logs or support bundles, this can leak credentials and user activity without any user-facing warning.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The utility silently reads an identity value from a local workspace file and uses it for subsequent account resolution. For a fish video analysis skill, undeclared identity harvesting from local files is unnecessary and weakens user control over which identity is used in remote interactions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request wrapper injects and transmits identity fields and authentication tokens in outbound HTTP requests, while also adding user-related metadata into request bodies by default. In the context of a fish respiratory-rate monitor, this creates unnecessary external data transmission and expands the blast radius if endpoints, logs, or dependencies are compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | **4 级告警策略递进**(mild → moderate → severe → urgent/Level 4),浮头吞气 ≥ 5 分钟或多条同发进入 Level 4 |
| 🔎 使用提醒 | 单日告警上限:Level 1 不限 / Level 2 × 6 / Level 3 × 3 / Level 4 不设上限(紧急安全优先) |
| 🔎 使用提醒 | 红线约束 |
| 🧑‍⚖️ 结果性质 | **禁止**对鱼做"鳃病 / 烂鳃 / 氨中毒 / 亚硝酸盐中毒 / 寄生虫感染"等具体疾病诊断 |
| 🔎 使用提醒 | **🚨 绝对禁止**输出具体药物名称、剂量、给药方案 |
| 🔎 使用提醒 | **禁止**长期存储完整鱼缸视频(≤ 7 天,仅入库异常呼吸事件片段;公共水族馆/实验室按管理规定) |
| 🔎 使用提醒 | **禁止**用于商业广告 / AI 训练;禁第三方共享 |
Confidence
81% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2