Back to skill

Security audit

Pet Litter Box Usage Monitor (Frequency & Duration) | 宠物猫砂盆使用频次与时长

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned for cloud litter-box video analysis, but it quietly links uploads to a persistent user identity and stores service tokens, so users should review it before installing.

Install only if you are comfortable sending litter-box footage or video URLs to the vendor service and having reports associated with a persistent internal user identity. Review the vendor’s retention and access practices, avoid videos containing people or sensitive household details, and be aware the skill may create a local data database containing service tokens.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill directs execution of local Python scripts, file handling, network access, and shell-like invocation, but declares no permissions or equivalent trust boundary to signal those capabilities. This creates a transparency and policy-enforcement gap: a host may expose sensitive resources or allow risky operations without users or reviewers being clearly informed.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script exposes a report-history listing function via `show_analyze_list(open_id)` that is outside the manifest’s stated behavior of analyzing a supplied video. In a health-monitoring context, prior litter-box usage reports are sensitive behavioral data, and exposing them increases the risk of unauthorized data discovery or over-collection beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code silently resolves an internal `open_id` and then uses it for listing analysis history, even though identity handling is not justified by the manifest’s narrow purpose of analyzing provided litter-box videos. This creates an unnecessary identity/data linkage surface and could enable access to stored behavioral records tied to a user without clear disclosure or need.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This module exposes generic add/edit/delete/list and arbitrary HTTP verb helpers that are far broader than the skill's declared litter-box monitoring purpose. In an agent-skill context, unnecessary network and CRUD primitives enlarge the attack surface and can be repurposed by other skill code to access, modify, or exfiltrate remote data beyond the expected workflow.

Context-Inappropriate Capability

Low
Confidence
87% confidence
Finding
User-account lookup by username is unrelated to litter-box usage analysis and introduces identity-related capability without a clear functional need. Even if harmless in isolation, this kind of excess privilege can enable account enumeration or become a building block for broader misuse when combined with other network functions in the skill.

Description-Behavior Mismatch

Medium
Confidence
81% confidence
Finding
YamlUtil.save() will write arbitrary caller-supplied content to any caller-supplied path, and it silently suppresses errors, which can hide misuse or abuse. In a larger skill ecosystem, this creates an unnecessary file-write primitive unrelated to litter-box video analysis and could enable overwriting local configuration or dropping files in unintended locations if path input ever becomes influenced by untrusted data.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This module implements broad persistence and mutation capabilities for user/account-style data that are not justified by the stated litter-box video analytics behavior. Excess storage and account manipulation logic increase the attack surface, create unnecessary retention of personal data, and make abuse or future feature creep more damaging if the skill is compromised.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The User model stores identity and authentication-adjacent fields such as username, email, token, and open_token, yet the skill description does not establish a need for handling such data. Collecting and mutating these fields in a pet-health analytics skill creates unnecessary exposure of sensitive credentials or identifiers, and the generic DAO methods could facilitate unauthorized access or overwrite if reused unsafely elsewhere.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The utility layer performs automatic account creation/login, token retrieval, and local token persistence that are unrelated to litter-box video analysis. This creates hidden identity and credential side effects, and can transmit user-linked identifiers to backend services without clear user consent, which is especially concerning given the declared purpose is pet-behavior analytics rather than account provisioning.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This code reads workspace identity material from local files and persists or derives a default open-id for future reuse, even when the skill's advertised function is video-based cat litter monitoring. The hidden collection and reuse of identity data expands the privacy footprint and can enable cross-session tracking or unintended linkage between a pet-monitoring workflow and backend user identity.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill accepts local video files and remote URLs, then states that an API service will process or download them, but it does not clearly warn that user-provided content may be uploaded or transmitted to a cloud service. This can cause unintentional disclosure of sensitive household, location, or pet-health footage and metadata without meaningful user awareness or consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Sensitive internal identity resolution occurs automatically and is intentionally hidden from normal CLI help, which prevents informed user consent and obscures privacy-relevant behavior. In this skill, that identity can be used to retrieve historical pet health-related monitoring outputs, making the undisclosed collection/use more dangerous than a purely cosmetic internal identifier.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
When a local path is provided, the skill reads the entire file and forwards its contents to the remote analysis API, but this file contains no user-visible disclosure, consent step, or data-minimization control around that transfer. In a pet-health video workflow, uploaded videos may contain sensitive household imagery, people, children, or metadata, so silent exfiltration to a backend service creates a real privacy and compliance risk if users believe processing is local or do not understand what is being transmitted.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script accepts a hidden `--api-key` parameter while suppressing it from `--help`, which obscures the presence of credential handling from users and reviewers. Hidden credential inputs reduce transparency, make misuse harder to detect, and increase the chance that operators unknowingly pass secrets into an unvetted skill or via unsafe shell history/process arguments.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user-provided local file paths or URLs into `skill.get_output_analysis(...)` for remote-style analysis without clearly disclosing that video content may leave the local environment. Because the content is pet-monitoring video from homes, catteries, or clinics, silent transmission can expose sensitive visual data, location details, timestamps, and operational information to external services without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The function silently reads a sensitive identity value from data/smyx-api-key.txt and treats it as an internal identity source. Undisclosed use of workspace secrets or identity files can surprise operators, leak account linkage into unrelated workflows, and increase the chance that a local secret is reused in contexts the user did not intend.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2