ClawHub
Back to skill

Security audit

Livestock Counting | 养殖场盘点计数

Security checks for vulnerabilities and agentic risk

Overview

The skill’s livestock counting function is real, but it also silently manages identity, creates or reuses account state, stores tokens locally, and can query cloud report history automatically.

Install only if you are comfortable with barn or livestock media and report metadata being sent to the configured Life Emergence service, and with the skill automatically creating or reusing an internal identity, querying cloud history, and storing account tokens/profile data in a local workspace database. Use an isolated workspace and avoid placing sensitive identity or API-key files where this skill can read them unless that behavior is intended.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
The list() method applies filters using getattr(self.__model__, key) where key comes from the caller. Although SQLAlchemy prevents raw SQL injection here, an untrusted caller can still probe or access unintended model fields, bypass business restrictions, or trigger errors through unexpected attribute names. In this skill, that matters more because the DAO exposes generic access to a user table containing profile and token fields unrelated to livestock counting.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
The count() method has the same issue as list(): caller-supplied keys are dynamically resolved into model attributes without authorization boundaries. This can enable schema probing, logic abuse, or counting over sensitive attributes in a generic user-data store, which is broader than the stated livestock-counting purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read/write local files, invoke shell commands, access environment-derived identity, and call remote APIs, yet it declares no explicit permissions or trust boundaries. This mismatch can cause over-privileged execution and poor operator visibility into what the skill is allowed to do, especially because uploaded media is saved locally and history queries are sent to a cloud service.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This file exposes broad generic API wrappers for add/edit/delete/list and arbitrary HTTP GET/POST/PUT/DELETE operations that are not constrained to livestock-counting workflows. In an agent skill advertised for image/video livestock counting, these capabilities materially expand what the skill can do, enabling unintended external actions or data access if higher-level code or prompts can influence the target URLs or payloads.

Context-Inappropriate Capability

Low
Confidence
86% confidence
Finding
The get_user_by_username function adds a user-account lookup capability unrelated to counting livestock from media. Even if intended for convenience, it introduces unnecessary identity enumeration or data-access functionality that broadens the skill's reachable attack surface beyond its stated purpose.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This file defines a full user-account model and DAO, including identity and token-related fields, which is outside the declared livestock-counting function. Such scope expansion increases the attack surface and creates unjustified collection and retention of user data in a skill that should only analyze images/videos for headcount.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The generic DAO initializes shared local databases, performs broad CRUD, and alters schema at startup, which substantially exceeds a counting-only skill's expected behavior. Even if not overtly malicious, this architecture enables persistent state, cross-feature data mingling, and future misuse beyond the skill's stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores personal profile data and especially token/open_token values without any visible need for livestock inventory analysis. Retaining authentication tokens and PII in a local SQLite database raises the risk of credential theft, privacy violations, and unauthorized account linkage if the workspace or database is accessed.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs outbound API authentication, token handling, and account lifecycle actions that are unrelated to a livestock-counting skill's stated purpose. In this context, hidden network-capable identity management materially increases attack surface and enables undisclosed data exfiltration or platform account manipulation under the guise of image analysis.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code derives or creates user identities from local files and a database, then caches them as current identity state without any connection to livestock counting. In a media-analysis skill, silently sourcing local identity material is dangerous because it can repurpose local state for authentication and subsequent external requests without user awareness.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The HTTP helper silently calls an external health endpoint to register or log in a user with locally derived identifiers. That behavior is unrelated to counting animals in images and creates a covert account provisioning path that can transmit identifiers off-host and create persistent remote accounts without informed consent.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code inspects the agent workspace, environment variables, and filesystem layout, and creates data/skills directories automatically. While this may support agent portability, it exceeds what is expected for a simple livestock-counting skill and can enable broader filesystem interaction and persistence than users would reasonably infer from the skill description.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The history-report trigger phrases are broad enough that ordinary user language could unintentionally invoke a cloud history lookup. Because the skill says this should happen automatically and must query the API directly, users may trigger remote access to historical data without realizing they asked for it.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments and media files are automatically saved as local files, but it does not clearly warn the user about persistence, retention, or storage location. Silent local persistence increases risk of sensitive farm imagery being retained longer than expected or exposed through later file access on the host.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill mandates direct cloud API queries for historical reports without clearly informing users that report-related data retrieval occurs against a remote service. This creates a transparency and privacy problem, particularly because historical inventory reports may reveal operational details about a farm or facility.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script initializes an internal identity via OpenIdUtil.resolve_current_open_id using a hidden --open-id parameter and without clear user disclosure. Hidden identity binding can cause requests and historical report access to be performed under an unexpected account context, creating privacy and authorization risks if report listing or backend actions are tied to that identity.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The code reads the entire local file and sends it to a remote analysis API without any user-facing disclosure, confirmation, or visible privacy notice in this execution path. For camera images/videos from barns, this can expose sensitive operational data, location details, worker imagery, or proprietary farm conditions to an external service unexpectedly.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script performs network-backed analysis while accepting a hidden --api-key parameter and a configurable --api-url, but it does not clearly disclose remote transmission, destination trust boundaries, or credential handling to the user. This can lead to accidental exfiltration of sensitive media or misuse of credentials, especially because hidden parameters reduce operator awareness and auditability.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
When debug mode is enabled, urllib3/http.client logging is turned on globally, which can expose request URLs, bodies, and authorization material in logs. Even though later code truncates some headers for printing, lower-level HTTP debug logging may still capture sensitive data without a user-facing warning.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code reads a locally stored identity value from data/smyx-api-key.txt and uses it as an internal identifier for later request flows, without disclosure in the skill context. For a livestock-counting skill, automatically sourcing and later transmitting identity-linked local data is unexpected and increases privacy and consent risk.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The HTTP helper makes external requests, populates authentication headers, and persists returned tokens and user records locally, but this behavior is not aligned with the declared media-counting purpose. Undisclosed token persistence and remote communication create privacy, persistence, and abuse risks if the skill is installed in a trusted automation environment.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
The requests.post call transmits identity-related data to an external endpoint as part of a silent login/registration flow. External transmission is especially concerning here because the skill's advertised purpose is livestock counting, so this network behavior is unexpected and can leak locally sourced identifiers or create remote state without consent.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片支持 `jpg` / `png` / `jpeg`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 计数结果仅供存栏盘点参考，本技能不提供盘点管理建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |
Confidence
84% confidence
Finding
The hidden-instructions indicator suggests the manifest may contain invisible or obfuscated text intended to influence agent behavior outside normal review. In a skill that already directs shell execution, local file handling, and network access, hidden content increases the risk of instruction smuggling, policy bypass, or reviewer deception.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-livestock-counting-analysis"
description: "Automatically detects and counts livestock or poultry individuals from barn or passage camera images/videos, outputting total headcount with confidence for fast inventory. | 自动识别并统计畜禽数量，实现快速存栏盘点。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
88% confidence
Finding
The metadata-poisoning rule firing on the manifest description, combined with the hidden-character signal, indicates possible adversarial manipulation of tool or skill metadata. Poisoned metadata is dangerous because agents often trust manifest fields during routing and invocation, so an attacker can alter behavior or conceal risky capabilities before the main content is even examined.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2