gait test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.5

Overview

The skill performs the advertised cloud pet-gait analysis, but it also silently manages identities and stores reusable cloud tokens in the workspace, which deserves review before installation.

Install only if you are comfortable with pet media and report metadata being processed by the Lifeemergence cloud service, with automatic account-linked history lookup, and with reusable service tokens stored in a shared workspace database. Prefer a version that documents upload/retention behavior, requires confirmation for history access, stores credentials in a proper secret store, and fixes the credential-forwarding and dependency issues.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/util.py:568

Finding

Authentication Credentials Can Be Forwarded to Arbitrary Absolute URLs

Content

View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py, lines 568–608 and 642
Vulnerability Type: Unrestricted credential forwarding
Risk Level: High

Vulnerable Code

python

if not url.startswith("https://") and not url.startswith("http://"):
    url = cls.BASE_URL + url

python

headers.setdefault("X-Access-Token", ApiEnum.TOKEN)
headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY)
headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN)

python

response = requests.request(method, url, *args, json=data, params=params, headers=headers,
                            timeout=int(timeout), **argss)

Technical Analysis

RequestUtil.http_request accepts both relative URLs and arbitrary absolute HTTP or HTTPS URLs. Relative URLs are prefixed with the configured API base URL, but absolute URLs are used without validating their destination.

The method subsequently adds the cached access token, API key, and authorization token to the request headers regardless of the destination host or transport security. Consequently, any internal caller that can influence the url argument can cause credentials intended for the trusted service to be transmitted to an attacker-controlled server.

The reviewed gait-analysis CLI currently invokes fixed relative endpoints. Its advertised --api-url argument is passed to analyze_video but is not applied, so direct exploitation through that CLI option was not confirmed. Nevertheless, the shared request utility exposes an exploitable credential-forwarding primitive to current or future callers.

Attack Path

1. The Skill authenticates with the configured cloud service and caches values in ApiEnum.TOKEN, ApiEnum.OPEN_TOKEN, or ApiEnum.API_SECRET_KEY.
2. An attacker influences a caller of RequestUtil.http_request, directly or through another shared API method, to provide an absolute URL such as `https://attacker.ex ...[truncated 1071 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse destinations with urllib.parse.urlsplit and reject malformed URLs, embedded user information, nonstandard schemes, and unexpected ports.
2. Maintain an explicit allowlist of trusted HTTPS hosts. Compare normalized hostnames exactly rather than using string prefixes or suffixes.
3. Attach authentication headers only when the destination matches the corresponding trusted service.
4. Reject all plaintext HTTP destinations for authenticated requests.
5. Use separate request functions or requests.Session objects for authenticated first-party traffic and unauthenticated external traffic.
6. Disable automatic cross-origin redirects or validate every redirect destination before retaining authentication headers.
7. Remove or correctly implement --api-url. If custom endpoints are required, do not forward first-party credentials to them unless they pass an explicit trust policy.
8. Add tests proving that credentials are omitted for external hosts, HTTP destinations, deceptive subdomains, user-information URLs, and cross-origin redirects.

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/util.py:582

Finding

Cloud Authentication Tokens Are Stored Unencrypted in a Shared Workspace Database

Content

View full analysis

Vulnerability Details

File Locations:

• skills/smyx_common/scripts/util.py, lines 582–601
• skills/smyx_common/scripts/dao.py, lines 141–154 and 460–462

Vulnerability Type: Plaintext storage of reusable authentication credentials
Risk Level: Medium

Vulnerable Code

python

if found_user:
    ApiEnum.TOKEN = found_user.token
    ApiEnum.OPEN_TOKEN = found_user.open_token
    current__user_name = found_user.username
if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
    new_current_user = _get_or_create_user(current__user_name)
    if new_current_user:
        ApiEnum.TOKEN = new_current_user.get("token")
        ApiEnum.OPEN_TOKEN = new_current_user.get("openToken")

        current_user_info = new_current_user.get("userInfo")
        if current_user_info:
            current_user_info["token"] = new_current_user.get("token")
            current_user_info["openToken"] = new_current_user.get(
                "openToken")
            user_model = User.load(current_user_info)

            user = user_dao.save(
                user_model
            )

python

if not db_path:
    db_path = "smyx-common-claw.db"

db_path = self.get_db_path(db_path)

self.engine = create_engine(f"sqlite:///{db_path}", echo=False)

python

token = Column(String(500), comment="token")
open_token = Column(String(1000), comment="开放token")
source = Column(String(50), comment="token")

Technical Analysis

Authentication results returned by the remote login service are copied into a User model and persisted in SQLite. The token and open_token columns are ordinary string fields, with no application-level encryption or integration with an operating-system credential store.

The DAO intentionally redirects the database to the Agent workspace's shared data directory. This makes credentials reusable across executions, but also exposes them to any other process or Skil ...[truncated 1517 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid persistent token storage when short-lived in-memory credentials are sufficient.
2. Store credentials in an operating-system keyring, platform secret manager, or other credential store isolated from general workspace files.
3. If database persistence is unavoidable, encrypt token values with an authenticated encryption scheme and keep the encryption key outside the workspace.
4. Create the workspace data directory and database with owner-only permissions, such as 0700 for the directory and 0600 for the database on POSIX systems.
5. Use short-lived, narrowly scoped tokens and implement server-side revocation and rotation.
6. Do not share one credential database across unrelated Skills or Agent contexts. Separate credentials according to the least-privilege boundary.
7. Delete expired and revoked tokens rather than retaining them indefinitely.
8. Document token retention, storage location, expiry, and deletion behavior for administrators.

T08 · Insecure Dependencies

Warning

• Location: skills/smyx_analysis/requirements.txt:3

Finding

Ambiguous YAML Dependency Name Creates a Dependency-Confusion Risk

Content

View full analysis

Vulnerability Details

File Location: skills/smyx_analysis/requirements.txt, line 3
Vulnerability Type: Incorrect or ambiguous third-party package declaration
Risk Level: Medium

Vulnerable Code

text

pydash==8.0.6
SQLAlchemy==2.0.46
yaml==6.0.3

The shared component identifies the intended dependency differently:

File Location: skills/smyx_common/requirements.txt, line 3

text

pydash==8.0.6
SQLAlchemy==2.0.46
PyYAML==6.0.3

Technical Analysis

The source code imports the module as yaml, but the established Python distribution providing that module is declared elsewhere in the project as PyYAML. The analysis requirements instead request a distribution literally named yaml.

Python import names do not necessarily match package-index distribution names. Requesting the wrong distribution can cause installation failure or cause a package manager using a public, private, or mixed index to resolve an unintended distribution. If an attacker can publish or control the matching package/version on a configured index, package installation may execute attacker-controlled build or installation code.

No evidence was found that a malicious dependency is currently bundled with the project. The vulnerability is the unsafe and inconsistent dependency declaration.

Attack Path

1. An operator or automated installer processes skills/smyx_analysis/requirements.txt.
2. The package manager requests the distribution named yaml at version 6.0.3.
3. A configured package index resolves that name to an unintended or attacker-controlled distribution, or a private-index fallback retrieves it from an untrusted public index.
4. The package's build backend, installation hooks, or subsequently imported module executes code in the installer or Agent environment.
5. That code receives the privileges of the account installing or running the Skill.

If no matching distribution exists, ...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous requirement with the intended distribution:

   text

   PyYAML==6.0.3
   

2. Maintain one authoritative dependency manifest or generated lock file to prevent inconsistencies between components.
3. Pin package hashes using a hash-locked requirements file.
4. Restrict installation to explicitly trusted package indexes and disable unintended public-index fallback.
5. Generate and review a software bill of materials for all installed dependencies.
6. Add continuous-integration checks that validate requirement names, versions, hashes, and import compatibility.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Authenticated external API calls, reading local API keys, workspace discovery, user/open-id creation, local user-record updates, and remote registration/login behavior are highly sensitive actions that are not disclosed by the benign gait-analysis description. In context, this is especially dangerous because users may provide videos expecting vision-only processing while the skill also performs hidden identity and account operations.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-gait-analysis-lameness-analysis"
description: "Triggers when a user provides a pet side-view walking video URL or file for analysis; uses AI pose estimation to track limb joint trajectories, analyzes stride length, stance phase / swing phase duration, and left-right symmetry indicators, and identifies abnormal gait such as lameness or restricted joint mobility. Helps early detection of orthopedic conditions (arthritis, hip dysplasia, ligament injury) in pets. Application: home daily health monitoring, senior pet arthritis screening, vet clinic initial assessment, post-op rehab tracking. Does NOT provide medical diagnosis —

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not clearly warn users that provided video URLs or files may be sent to a cloud/API service for analysis or report retrieval. In this context, media and associated report history can be sensitive, so undisclosed external transfer creates significant privacy and trust risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores authentication/profile-like attributes including token and open_token, which are highly sensitive and not justified by the stated functionality of vision-based pet gait analysis. If compromised, these fields could expose account credentials or session artifacts, and their presence signals overcollection beyond the skill's expected trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The utility layer creates or reuses persistent user identities, logs into remote health APIs, caches tokens, and automatically injects identity fields into outbound requests. That behavior is unrelated to a pet gait-analysis skill's stated purpose of local vision-based video analysis and creates undisclosed account linkage and data exfiltration risk if pet videos, metadata, or user identifiers are later sent through this request wrapper.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior requires shell execution, network access, file reads/writes, and likely environment access. That mismatch weakens least-privilege boundaries and makes it harder for a host platform to constrain what the skill can do if the backing scripts are changed or abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default trigger is broad enough that ordinary pet-video requests may invoke the skill without a clear explicit boundary. In a skill that can save files, call shell commands, and contact cloud services, overbroad triggering raises the chance of unintended data processing and unnecessary remote transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Automatic triggering of historical report queries from broad natural-language phrases can expose sensitive report metadata when the user did not clearly request account-linked retrieval. Because the skill also uses internal identity association, accidental or ambiguous invocation has meaningful privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states that uploaded files are automatically saved locally but does not provide a clear user warning in the description about this persistence. Silent local retention of user-provided media creates privacy, consent, and data-minimization issues, especially for health-adjacent content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The output header explicitly labels the result as 'pet gait analysis (lameness/arthritis)', which overstates the skill’s permitted scope and can cause users to interpret the output as disease detection rather than non-diagnostic gait pattern analysis. In a pet health context, this is risky because it may create unwarranted medical confidence and influence care decisions without veterinary confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The method returns a fixed Chinese-language heading, and there is no indication in this file that the user can choose or opt into that locale. This may violate language/locale policy because the skill appears to present output in a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script initializes and uses an internal open_id that is intentionally hidden from the CLI help, then allows history listing via --list based on ConstantEnum.CURRENT__OPEN_ID. That creates a privacy and authorization risk because analysis history may be accessed through implicit or undisclosed identity resolution, making it easier to retrieve another user's prior reports without clear user consent or visible authentication boundaries.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Several returned messages are fixed Chinese strings, such as the report header and export-link text, which forces a specific language in user-visible output. The file does not offer locale selection, fallback behavior, or document a justified region-specific restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill reads an arbitrary local file and sends its full contents to the backend analysis service, but this code provides no user-facing notice, confirmation, or minimization before upload. Because the skill handles pet videos that may contain sensitive household imagery or metadata, silent transmission creates a real privacy and consent risk even if the functionality is intended.

Content

No source excerpt is available for this finding.