Pet Litter Box Usage Monitor (Frequency & Duration) | 宠物猫砂盆使用频次与时长

• Outcome: Review
• Latest audit: Aug 30, 2026 · 8:55 AM UTC
• Version: 1.0.9

Overview

This skill does analyze litter-box media, but it also automatically uploads media, creates or reuses an account identity, stores tokens locally, and queries cloud history with limited user-facing control.

Review this skill before installing. It should only be used if you are comfortable with litter-box videos or URLs being sent to a remote service, cloud report history being queried automatically, and a local account/token database being created in the workspace. Avoid using it with private home footage, signed/internal URLs, or environments where local token storage is unacceptable unless the publisher narrows and clearly documents these behaviors.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 79% confidence
• Finding: This method applies caller-supplied filter keys directly to ORM attributes via getattr(self.__model__, key) with no allowlist. If untrusted input reaches filters, an attacker can probe model structure, trigger exceptions for invalid attributes, and query on sensitive fields that the skill should not expose, especially given this DAO also handles user/account records.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 78% confidence
• Finding: As in list(), this count() helper trusts arbitrary filter keys and maps them directly to model attributes. In a shared DAO that includes account/profile storage, this can enable unintended metadata disclosure or authorization bypass in higher-level code that assumes only benign fields are countable.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no declared permissions while its documented behavior clearly implies shell execution, file access, environment use, and network communication. This mismatch weakens user and platform trust boundaries because a seemingly simple media-analysis skill can actually read/write local data and call remote services without explicit disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest describes local litter-box behavior analysis, but the detected behavior includes persistent identity creation, remote authentication, token storage, cloud report listing, and delegating core analysis to a backend. This is dangerous because users may upload sensitive household video under false assumptions about where processing happens, what data is retained, and what additional account linkage or history access occurs.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script exposes a separate history-report listing path via `show_analyze_list()` that is outside the manifest’s described behavior of analyzing a user-supplied litter-box video. This creates an unexpected data-access capability and increases the risk of unauthorized exposure of prior monitoring reports, especially because the data is health-adjacent and tied to user/account identity.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code resolves an internal `open_id` and uses it to retrieve analysis history even though the stated purpose is only to analyze a provided video. Tying hidden identity resolution to historical report access creates a privacy and authorization risk: a user may unknowingly trigger access to stored behavioral/health-related records, or the mechanism may be abused to retrieve another account’s data if identity handling is weak.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This file exposes generic add/edit/delete and raw http_get/http_post/http_put/http_delete wrappers that are not constrained to the stated litter-box video-analysis function. In an agent skill context, broad network and CRUD primitives increase the attack surface by enabling unrelated outbound requests or backend state changes if other parts of the skill can influence URLs or request data.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The get_user_by_username capability is unrelated to litter-box monitoring and suggests access to account or directory data beyond the declared purpose of the skill. Even if not directly exploitable here, unnecessary identity lookup functions violate least privilege and could enable user enumeration or privacy exposure if invoked by adjacent code paths.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This skill advertises litter-box video analysis, but the included shared DAO persists and mutates unrelated local user/account data. That scope mismatch increases privacy and trust risk because the skill can maintain state about identities and accounts beyond what is needed for behavioral video analytics.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code automatically creates and alters a local SQLite schema on initialization, which exceeds the manifest's implied read/analyze workflow for a video-analysis skill. Silent stateful persistence expands attack surface, creates hidden data retention, and may surprise users who did not consent to local database modification.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The User model stores authentication/profile material including token and open_token, plus identity fields such as username, realname, email, and birthday, none of which are justified by litter-box monitoring. Collecting and persisting this data in a local shared SQLite database creates unnecessary exposure of sensitive personal and authentication data if the workspace is accessed by other components or compromised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs automatic user provisioning, token recovery, and authenticated API bootstrapping that are unrelated to litter-box video analysis. This creates hidden account lifecycle and credential-handling behavior, expanding the skill from local analysis into undisclosed identity management and remote service access, which is especially suspicious given the narrow declared purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads identity material from a workspace file and local database, then silently reuses or creates an open-id for future requests. That enables the skill to assume or bootstrap a user context without user awareness, which can lead to impersonation, unauthorized API actions, and cross-skill identity leakage.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The workspace-discovery logic inspects agent filesystem layout and creates data/skills directories outside the immediate task of analyzing cat litter-box footage. In the context of a narrowly scoped analysis skill, this broader environment awareness and write capability increases the blast radius for persistence, data access, or interference with other agent workspaces.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger rules are broad enough that ordinary mentions of litter-box monitoring, urinary conditions, or history queries may auto-activate file handling or cloud report access. Over-broad activation increases the chance of unintended processing of user media or accidental retrieval of prior reports without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not clearly warn that uploaded videos, derived reports, and related identifiers may be transmitted to and persisted by a cloud service. In the context of home or veterinary monitoring, this can expose sensitive household, behavioral, and potentially account-linked data without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` performs internal identity resolution without user-facing disclosure, and the argument is intentionally suppressed from help output. Hidden collection or derivation of account identity is dangerous because it undermines informed consent and can silently expand the scope from content analysis to user tracking or access to stored account-linked data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code reads an arbitrary local file from the provided path and packages its full contents for transmission to the external analysis service, but this file contains no visible user-facing notice, consent gate, or data-minimization step. Because the skill processes pet-area videos that may contain people, homes, schedules, or other sensitive footage, silent upload can expose private data and create compliance and privacy risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill forwards user-supplied remote video URLs directly to the backend analysis service without any visible disclosure in this file that the external service will fetch or process that URL. This can unintentionally share sensitive internal, signed, or private URLs with a third party and may also cause the service to retrieve resources the user did not fully understand were being delegated externally.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script accepts either a local file path or a URL and passes it to `skill.get_output_analysis(...)`, which appears to invoke an external analysis service, but the CLI flow only prints 'analyzing video' and does not clearly warn the user that local video content or remote URL data may be transmitted off-host. Because the skill processes potentially sensitive home or veterinary surveillance footage, silent network transmission creates a meaningful privacy and data-handling risk even if it is expected by the feature design.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Database creation and mutation are performed automatically during DAO initialization with no user-facing notice or confirmation. In the context of a skill presented as media analysis, silent persistence can violate user expectations and lead to unconsented retention of operational or personal data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The utility reads identity material from data/smyx-api-key.txt and uses it as an internal identity source without any user-facing disclosure. Even before transmission, silently harvesting identity/credential-like material from shared workspace storage is dangerous because it can repurpose secrets across tasks and violate user expectations.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The code automatically sends openId/mobile/source data to a remote login/registration endpoint to create or recover an account, with no clear disclosure tied to the litter-box analysis workflow. This undisclosed transmission of identity data violates least surprise and can enroll users in backend services they did not knowingly authorize.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This POST transmits identity-related fields to an external service as part of silent login/registration. In a skill advertised for video-based cat health behavior analysis, that outbound data flow is not obviously necessary and becomes more dangerous because it is hidden inside a shared utility rather than surfaced as an explicit permissioned action.

Hidden Instructions

High

• Category: Prompt Injection

Content

| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🔎 使用提醒 | 多猫家庭需要先建立个体识别基线（多次提交带个体识别的样本），首次使用可能仅提供全局统计 |
| 🔎 使用提醒 | 频次/时长异常阈值默认采用 mean ± 2σ，可在 API 端按猫个体自定义 |
| 🧑‍⚖️ 结果性质 | 分析结果仅作为如厕行为参考，不替代兽医泌尿科检查 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，API 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 74% confidence
• Finding: The hidden-instructions indicator suggests the file may contain invisible or non-obvious control text near operational constraints and report-handling guidance. Hidden text in a skill manifest is risky because it can conceal behavior-shaping instructions from reviewers, including directives around network use, output formatting, or data handling that are not apparent in normal rendering.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2