Back to skill

Security audit

gait test

Security checks across malware telemetry and agentic risk

Overview

This skill does pet gait analysis, but it also silently handles identity, local account storage, tokens, and cloud history access that users should review before installing.

Install only if you are comfortable with this skill sending pet videos or URLs to a remote service, creating or reusing a local identity, storing local user/token data, and retrieving prior report links from the cloud. The publisher should clarify permissions, storage location, retention, account binding, and how users can disable history and identity-linked behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions while its instructions clearly require shell execution, network access, file read/write, and environment use. This mismatch undermines least-privilege controls and can cause the runtime or reviewer to underestimate what the skill will actually do, especially when handling local files and cloud lookups.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation expands the skill from simple gait analysis into cloud-based historical report retrieval and report-link generation, which is outside the stated manifest behavior. Scope drift like this can expose additional user data and backend functionality without clear consent, review, or policy gating.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The trigger rules instruct automatic historical report querying based on keywords, even though the manifest says the skill should trigger when a user provides a video or file for gait analysis. Automatic expansion into account-linked history access increases the chance of unintended data disclosure and surprise backend calls.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill directs the system to automatically reuse or create a local default user identity when no upstream identity is provided. This can misassociate reports across sessions or users, leading to unauthorized access to historical medical-style pet data and cross-tenant privacy leakage.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill exposes a history-listing function via `show_analyze_list()` that is not reflected in the stated analysis-only behavior. That creates an unintended data-access surface where prior gait analysis reports may be enumerated or retrieved, potentially exposing another user's pet health-related data if identity controls are weak or bypassable.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code resolves an internal user identity and then uses that identity for report access in a tool presented as simple video analysis. This expands the trust boundary from stateless media processing to user-scoped data access, and if the identity resolution can be influenced or defaults incorrectly, it can enable unauthorized access to stored analysis history.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The comment claims user input is not required for identity, but the code still conditionally accepts `args.open_id` and passes it into identity resolution. That mismatch is dangerous because it can mislead reviewers and operators into believing the identity is internally derived, while an attacker may be able to supply or influence an identifier used for accessing report data.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script includes a `--list` path that retrieves account-scoped analysis history via `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the declared single-video gait-analysis behavior. Undocumented history access expands the skill's data surface and can expose prior user submissions or results if invoked by an agent or caller unexpectedly.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code resolves a persistent `open_id` and uses `ConstantEnum.CURRENT__OPEN_ID` to fetch analysis history, introducing account-linked data access not justified by the stated purpose of one-off gait analysis. Persistent identifiers increase privacy risk because they enable cross-session correlation and may allow retrieval of historical pet health-related records if access controls are weak or misused.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This file exposes generic HTTP and CRUD wrapper methods (`add`, `edit`, `delete`, `http_get`, `http_post`, `http_put`, `http_delete`) that are broader than the declared pet gait-analysis purpose. In a skill expected to analyze uploaded pet videos, such reusable network primitives enlarge the attack surface by enabling arbitrary backend actions or data access if higher-level code passes attacker-influenced URLs or payloads.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file contains generic DAO logic and a User/UserDao for managing account-like records, which is unrelated to the advertised pet gait analysis function. In a narrowly scoped vision-analysis skill, hidden user-record persistence materially expands the data-handling surface and raises the risk of unauthorized collection, retention, or mutation of user information.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores personal profile data and authentication-like secrets such as token and open_token, yet the skill description only justifies pet video gait analysis. Collecting and persisting sensitive identifiers and tokens without clear necessity creates privacy and account-compromise risk if the local database is exposed or reused across skills.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This utility layer performs persistent identity resolution and local user provisioning logic that is unrelated to a vision-only pet gait analysis skill. The mismatch between declared purpose and implemented capability increases the risk of undisclosed account creation, identity binding, and cross-skill tracking without informed user consent.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The HTTP helper silently auto-registers or logs in users against remote health endpoints, then injects tokens and user identifiers into outbound requests. For a gait-analysis skill that claims to only analyze video, this is dangerous overreach because it can transmit identity and create remote accounts without a clear user-facing action or disclosure.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code reads a workspace-level identity file, falls back to local database records, and creates persistent default open-id values when none exist. For this skill context, that creates unnecessary long-lived identifiers and local account state, enabling hidden tracking and identity persistence beyond what is needed for simple video analysis.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The workspace detection and directory-management logic inspects agent environment details and creates data/skills directories. While not directly an exploit primitive, it grants broad agent-management capability unrelated to pet gait analysis, increasing the blast radius if other code abuses these paths for persistence, data collection, or cross-workspace interference.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill instructs automatic saving of uploaded attachments and media to local files without clear user-facing disclosure about retention, location, or cleanup. Because the inputs are pet health videos, this creates avoidable privacy and data-handling risk if files persist beyond the immediate analysis task.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Hidden identity resolution without clear user-facing disclosure is a security and privacy issue because the skill silently binds operations to an internal account context. In a skill that appears to only analyze a provided video, this unexpected identity handling increases the chance of privacy violations, confused-deputy behavior, or unauthorized access to historical data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code reads arbitrary local file contents from a supplied path and uploads the bytes to the external analysis service, but this file contains no user-facing disclosure, consent check, or boundary on what local path may be submitted. In a skill that can process local files, that creates a privacy and exfiltration risk if users or upstream components pass sensitive local files by mistake, especially because the skill also accepts URLs and appears designed to send media off-box for analysis.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The function reads a sensitive workspace credential/identity file without any user-facing disclosure or runtime consent. In this skill context, silently harvesting a workspace identifier is particularly problematic because the manifest describes gait analysis, not credential access or identity bootstrapping.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This code sends identity-related fields such as openId, mobile, and source to a remote endpoint without user-facing disclosure. Even if used for backend account bootstrap, undisclosed transmission of identifying/authentication-related data violates least surprise and creates privacy and account-correlation risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB;建议侧面视角、≥30fps、宠物直线行走 3~5 步 |
| 🔎 使用提醒 | 若视频角度不佳或宠物未完整行走,可能返回 "insufficient_gait_data" |
| 🧑‍⚖️ 结果性质 | 分析结果仅作步态参考,不替代兽医骨科专业检查 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
| 📁 格式支持 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown 表格格式输出,包含"报告名称"、"宠物类型"、"分析时间"、"点击查看"四列,其中"报告名称"列使用`宠物步态分析报告-{记录id}`形式拼接, "点击查看"列使用 `[🔗 查看报告]()` 格式的超链接,用户点击即可直接跳转到对应的完整报告页面 |
Confidence
76% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2