Back to skill

Security audit

Pet Grooming Effect Assessment (Mats/Dandruff) | 宠物梳毛效果评估(毛结/皮屑)

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform the pet-grooming analysis it advertises, but it also automatically creates or reuses an identity, contacts cloud services, and stores account tokens locally without clear user control.

Review before installing. Use it only if you are comfortable sending pet images/videos and report-history requests to the configured cloud service, and with the skill creating or reusing an internal identity plus storing service tokens in a workspace SQLite database. Prefer a version that requires explicit confirmation before cloud history lookup, remote login/registration, and local token persistence.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The manifest advertises no explicit permissions while the skill instructions require shell execution, local file handling, network access, and likely environment-based identity/token use. This creates a transparency and governance gap: users and hosting systems cannot accurately assess the skill's real privileges before activation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as a pet grooming image-analysis tool, but its documented behavior extends into persistent identity management, token/account handling, remote API login, local storage, and historical report retrieval. That mismatch is dangerous because users may consent to harmless-looking media analysis without realizing the skill can create accounts, persist identifiers, and access cloud-linked records.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The tool’s stated purpose is grooming image/video assessment, but it also exposes a hidden history-listing feature bound to an internal user identity via --list and suppressed open-id handling. Hidden secondary functionality that retrieves user-linked records increases the risk of unauthorized data access, privacy violations, and deceptive behavior because users are not clearly informed that identity-scoped history is being accessed.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script resolves an internal current user identity even though the visible functionality is only media analysis. This creates unnecessary identity coupling and can enable silent tracking, cross-user data access, or retrieval of user-associated history without transparent user awareness, which is especially concerning in a skill that appears unrelated to account operations.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially contradicts the declared skill purpose: it operates as a generic video analysis/history CLI rather than an image-based pet grooming assessment tool. This kind of capability mismatch is dangerous because users and integrators may grant access, route data, or rely on outputs under false assumptions, enabling unintended data handling and misuse of a broader analysis backend.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The CLI help text and function descriptions repeatedly present this as a video analysis tool, which conflicts with the manifest's grooming-image assessment description. Misleading documentation increases the likelihood of inappropriate data submission, incorrect operator trust, and accidental exposure of unrelated media to external services.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
This file exposes generic CRUD and arbitrary HTTP wrapper methods that are broader than the skill's declared purpose of grooming-image assessment. In a skill context, such reusable network primitives can enable unscoped outbound access or unintended backend actions if other components pass attacker-controlled URLs or parameters, increasing the attack surface well beyond the stated functionality.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The http_post/http_put/http_get/http_delete methods accept an arbitrary url argument and directly forward requests, creating a general-purpose outbound network capability. For a pet grooming assessment skill, this capability is not justified by the manifest and could be abused for unauthorized data exfiltration, SSRF-like access to internal services, or interaction with attacker-controlled infrastructure.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file implements generic user persistence, including identity and token handling, which is unrelated to the declared pet grooming image assessment purpose. Capability mismatch is dangerous because it expands data collection and persistence beyond user expectations, increasing the chance of covert account tracking, unauthorized retention of sensitive data, or hidden cross-feature state storage.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores personal identity fields and authentication-like tokens despite the skill being described as an image-based pet grooming evaluator. In this context, collecting username, realname, email, birthday, token, and open_token is unjustified and materially raises privacy and credential-handling risk if the database is accessed, leaked, or reused by other components.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility code performs identity resolution, token bootstrap, local user lookup, and remote account creation/login flows that are unrelated to the stated pet grooming image-assessment purpose. That hidden capability can cause unauthorized account provisioning and outbound data transmission under a derived identity, greatly expanding the skill's privilege and privacy footprint beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads an identity from a workspace file and, if absent, creates and persists a default user identity in the local database. For a grooming-quality assessment skill, silent persistence of user identity is unnecessary and creates tracking and impersonation risk if the workspace or database is shared or later reused by other components.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The workspace-detection helpers discover agent roots and create agent-scoped data and skills directories, which is broader environment-management functionality than needed for image-based grooming assessment. In context, this increases the skill's ability to inspect and modify the agent workspace, enlarging the blast radius if the skill is abused or compromised.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default trigger activates whenever a user provides relevant pet image/video content, which is broad enough to cause unintended execution. In this skill, unintended activation matters because execution may save files locally and initiate more privileged analysis workflows than the user expected.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The history-query auto-trigger uses broad phrases like viewing historical reports and is configured to directly call a cloud API. This can lead to accidental disclosure or retrieval of cloud-linked records when a user mentions reports casually, without realizing authenticated remote access will occur.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments and media files are automatically saved locally, but it does not clearly warn users about this persistence behavior in a prominent, consent-oriented way. Local file persistence increases exposure of potentially sensitive images/videos and may violate least-surprise and data minimization expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill auto-routes history queries to a cloud API but does not provide a clear, upfront warning that user-associated data will be sent to or retrieved from a remote service. This is dangerous because the skill also describes automatic identity association, increasing the chance of silent access to account-linked data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code reads arbitrary local file content and prepares it for upload to the remote analysis service without any user-facing warning, consent checkpoint, or in-function restriction beyond extension and size checks. In this skill context, users may expect local grooming media analysis, but silent transfer of local files to an external service creates a real privacy and data-handling risk, especially if sensitive or misselected files are provided.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code forwards a local file path or remote URL into backend analysis without any user-facing notice about transmission, retention, or privacy implications. In this skill context, users may expect harmless local grooming assessment, so silent submission of pet media or linked remote content to an API creates privacy and consent risks that are amplified by the manifest/implementation mismatch.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The function silently reads an internal identity value from data/smyx-api-key.txt and uses it as an operational identity without user-facing notice. That can lead to covert identity reuse, confusion about which account is being charged or acted under, and leakage of internal credentials if the workspace is multi-tenant or improperly permissioned.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This code automatically authenticates and sends outbound requests using a derived or persisted user identity and tokens, without an explicit user prompt at the point of use. In a skill presented as pet grooming assessment, that undisclosed networked account activity is especially risky because users would not reasonably expect hidden login/registration and token-backed requests.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2