Livestock Counting | 养殖场盘点计数

• Outcome: Review
• Latest audit: Nov 4, 2026 · 2:42 AM UTC
• Version: 1.0.14

Overview

This cloud counting skill needs review because it mishandles account credentials and can upload footage despite an option promising to skip analysis.

Use a corrected release before supplying private footage or valuable credentials. It should honor export-only mode, separate credentials from account identity, restrict authenticated destinations, protect stored tokens, and disable automatic HTTP debugging. Selected media goes to LifeEmergence, and account creation may occur automatically. Confirm the provider's retention, pricing, and account-isolation terms; these server-side properties were not verified. The inspected artifacts support Review, not a finding of malicious intent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk implements user-database management rather than animal detection or inventory counting. Its count method counts database records, not animals in images or videos. While database access can support a counting application, this chunk specifically manages user identities, personal data, and authentication-token fields without a demonstrated connection to the declared purpose. No image/video processing, animal detection, or confidence estimation appears in the supplied code. This assessment is limited to the supplied chunk; it does not establish what other skill components do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk contains no image/video analysis, animal detection, counting, or confidence calculation. Its being a shared utility module means that absence alone would not establish a mismatch. However, its automatic identity provisioning, remote account registration, credential persistence, and payment-service integration introduce material account-management behavior not disclosed by the livestock-counting description. Routine formatting, filesystem helpers, polling, and HTTP transport are not independently treated as mismatches. The finding is limited to the supplied code; it does not establish that the full skill lacks counting functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk is generic infrastructure and a nonfunctional chat-agent stub, not an implementation of animal counting. No agent command actually executes because the subprocess code is commented out. The imported base classes and API service are not supplied, so their behavior cannot be assessed; however, the visible code does not substantiate the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

HTTP wrappers, pagination, and download URLs could support an image-processing service and are not inherently mismatches. However, the code also exposes user lookup by username, an account-related capability not represented in the description. No detection, counting, image/video processing, or confidence calculation is visible in this chunk. The assessment is limited to the supplied code; it does not establish what other parts of the skill implement or whether these methods are invoked.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-livestock-counting-analysis"
description: "Automatically detects and counts livestock or poultry individuals from barn or passage camera images/videos, outputting total headcount with confidence for fast inventory. | 自动识别并统计畜禽数量，实现快速存栏盘点。"
version: "1.0.17"
license: "MIT-0"
---

# 🔢 Livestock Inventory Counting | 养殖场盘点计数

> 自动识别并统计畜禽数量，实现快速存栏盘点。
>
> **智能存栏盘点中枢** · 畜禽舍/通道图像视频智能分析 · 个体检测计数 · 存栏总数与置信度 · 历史报告云端查询

---

## 🧭 技能概�

Caller-supplied HTTP destinations receive shared service credentials without a destination restriction.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The helper accepts arbitrary absolute HTTP or HTTPS URLs and attaches shared X-Access-Token, X-Api-Key, and Authorization credentials without checking the destination. If an untrusted caller can influence the URL, it can direct those credentials to an attacker-controlled server; HTTP also permits plaintext interception.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to run analysis, but supplying it does not prevent analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The parser advertises an export-only mode that will not perform analysis, but the flag is never checked. When combined with an input or list argument, execution can initialize identity and perform remote operations despite the caller's explicit non-analysis choice, potentially uploading private farm footage or incurring charges.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local file contents are submitted to the analysis API without disclosing the upload to the user.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The code reads the entire local file, packages it as a multipart file payload, and passes it to the analysis API. No prompt, user-facing log, or comment explains that the file contents will be transmitted; the existing comment only describes reading the file.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to analyze input, but does not prevent analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The export-only flag promises not to analyze input but is ignored after parsing. With an input or list argument present, the program still initializes identity and can perform remote processing, violating the caller's intended restriction and potentially disclosing footage or triggering billable work.

Content

No source excerpt is available for this finding.

The service exposes username-based user lookup unrelated to livestock counting.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

At L098-L101, get_user_by_username accepts a username and delegates to a user-lookup utility. Looking up user accounts is a separate capability from detecting and counting animals in images or videos, and the manifest does not declare account-management functionality.

Content

No source excerpt is available for this finding.

The skill includes user-account and credential persistence unrelated to livestock counting.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The User model supports persisting token and open_token directly as readable strings in a shared workspace SQLite database, without visible encryption or restrictive file-permission enforcement. Account support can legitimately underpin a hosted counting service, but unnecessarily retained credentials expose that account if another process, workspace participant, or backup reader can access the database.

Content

No source excerpt is available for this finding.

ai_chat documents invoking the OpenClaw agent and returning analysis, but its implementation never invokes the agent.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L25–L35 promises a subprocess-based OpenClaw invocation that returns an analysis result or session ID. The subprocess invocation is commented out, and the replacement empty dictionary at L68 causes result.stderr to raise AttributeError; the exception is caught, so the function returns None without performing analysis.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

Opening a path with mode 'w' immediately erases any existing contents, even before the caller writes anything. This generic open helper provides no comment, docstring, confirmation, or operation-specific log explaining that behavior; the exception handler only runs if opening fails.

Content

No source excerpt is available for this finding.

The request helper silently provisions remote accounts and persists user credentials beyond the declared livestock-counting purpose.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

An ordinary request can automatically invoke phoneLogin with registration enabled, transmit the selected identity, and persist returned authentication tokens without an explicit onboarding step. Remote authentication may support counting, but undisclosed account creation and credential retention introduce privacy and credential-exposure risks beyond the declared image-analysis operation.

Content

No source excerpt is available for this finding.

HTTP requests can silently trigger remote login or account registration and transmit the current identity.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The authentication helper sends silent=1 and register=1 alongside openId and mobile, so requesting an unrelated operation can also cause remote account provisioning. The shown code provides no explicit consent gate, making this an undisclosed identity-transmission and account-creation side effect rather than merely a network request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This POST transmits the selected username as both openId and mobile to a remote login/registration endpoint. The selection can use API_SECRET_KEY as the username, potentially copying a secret into identity fields and associated server records; external transmission alone would not be a vulnerability, but this implicit identity/secret disclosure is.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and files, including during module import.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is absent, without a comment, docstring, prompt, or log explaining this side effect. BaseEnum invokes this loader during subclass creation (L053 and L058), so importing the module can modify the filesystem without an explicit save request.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default