Livestock Fever Detection | 畜禽体温异常检测

• Outcome: Review
• Latest audit: Aug 27, 2026 · 11:18 PM UTC
• Version: 1.0.10

Overview

The skill appears intended for livestock temperature analysis, but it silently handles cloud identity, stores tokens locally, uploads media, and ships with development HTTP endpoints, so it needs careful review before installation.

Install only if you are comfortable with livestock media being uploaded to the configured service, report history being tied to an automatically managed identity, and credentials/tokens being stored in the workspace data directory. Review or change the dev HTTP endpoint configuration before use, and avoid running it on sensitive workspaces unless identity and token handling are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while its documented behavior includes shell execution, network access, local file reads/writes, and likely environment use. This mismatch weakens sandboxing and informed consent, because a host may permit the skill under a lower-trust profile than its actual capabilities require.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is image-based fever detection, but the behavior also includes identity creation, remote login, token storage, history retrieval, and report-link generation. This is a significant scope expansion involving authentication and persistent data handling, which creates privacy and account-security risk beyond what a user would reasonably expect from the description.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill exposes a history-listing capability tied to an internal user identity (`show_analyze_list(open_id)` and `--list`) that goes beyond the declared image/video fever-analysis function. Because identity is resolved internally and the interface includes hidden identity handling, this creates an access-control and privacy risk: a caller may retrieve prior reports associated with an internal identity without clear authorization checks or user disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill exposes a report-listing capability and constructs export URLs for prior analysis results, which is not required for simple fever detection and can reveal historical analysis metadata or report artifacts to callers. Because the code has commented-out open_id checks, access control appears to be weakened or absent in this layer, increasing the risk of unauthorized enumeration of reports.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation does not match the advertised livestock fever detection purpose and instead behaves as a generic video analysis/history wrapper. This kind of capability mismatch is dangerous because users, orchestrators, or policy systems may grant access based on the declared medical/agricultural use case while the code actually exposes broader analysis behavior and history retrieval, enabling unintended data processing or exfiltration paths.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The function claims to call an API and accepts api_url/api_key parameters, but ignores them and delegates to a local skill object instead. This is risky because it misleads reviewers and calling systems about where data is sent and what trust boundary applies, which can hide unauthorized local processing or bypass expected security controls around external API configuration and auditing.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The CLI presents itself as a generic video analysis tool rather than the advertised livestock fever detection skill. In a permissioned agent environment, misleading CLI/function descriptions can cause operators to invoke the tool on broader data types than intended, weakening least-privilege assumptions and increasing the chance of unauthorized or privacy-sensitive analysis.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This file exposes broad generic network and CRUD primitives (`add`, `edit`, `delete`, `http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the stated livestock fever-detection purpose. In an agent skill context, such arbitrary outbound request capability materially expands what the skill can do, enabling misuse for unintended data access, modification, or pivoting to unrelated internal/external services if higher-level code passes attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The `get_user_by_username` capability is unrelated to livestock temperature analysis and indicates access to identity or directory data beyond the declared function of the skill. In a skill execution environment, this kind of unnecessary user-enumeration functionality increases the attack surface and could be abused to discover valid accounts or retrieve sensitive user metadata.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file defines a generic `ai_chat` capability in shared skill code that is unrelated to livestock fever detection and accepts arbitrary prompt input. Even though the subprocess execution is currently commented out, exposing an agent-invocation interface in common code expands the attack surface and could be re-enabled or reused by other skills in ways that bypass intended task scoping.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The utility layer performs remote account lookup/login/auto-registration and persists tokens and user records, behavior unrelated to livestock fever detection from imagery. This expands the skill’s privileges and silently transmits identity data to backend services, creating unnecessary exposure of credentials and user metadata if the skill is installed or invoked in a sensitive workspace.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code resolves and persists an open-id by reading workspace files and local database state, then reuses or creates identities automatically. For an image-based fever-analysis skill, this identity management is unnecessary and increases privacy risk by coupling operation to hidden user identity state without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The utility code inspects environment variables, derives workspace roots from filesystem paths, and creates data/skills directories. In a fever-detection skill this is overbroad capability that can reveal deployment layout and modify agent workspace state outside the narrow scope of image analysis, increasing the blast radius if abused by other code paths.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow says uploaded attachments and media are automatically saved as local files, but it does not clearly warn users about local persistence, retention, or cleanup. In a security-sensitive environment, silent storage of user-supplied files can expose sensitive operational imagery, create unintended data retention, and increase breach impact if the host is compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill mandates direct cloud API queries for historical reports without a prominent user-facing disclosure that report-related data and identifiers will be transmitted over the network. This can surprise users and may expose sensitive farm-health metadata, especially because the skill also describes automatic identity association behind the scenes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` resolves or accesses user identity through a hidden mechanism with no clear user-facing disclosure. Hidden identity collection or impersonation hooks are dangerous because they can enable unauthorized access to user-scoped data, especially when combined with the report-listing functionality in this skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads the entire local file and sends its contents to a remote analysis service without any visible consent, disclosure, or minimization in this component. If a user provides the wrong path or misunderstands the operation, sensitive local media could be exfiltrated to an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Debug mode enables low-level HTTPConnection and urllib3 logging, which can expose request URLs, headers, bodies, and server responses. Because this same utility later handles tokens and identity fields, enabling debug can leak sensitive authentication or user data into logs without user-facing notice.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code reads a workspace file containing API-key/open-id identity material with no user notification or permission check. Even if intended for convenience, silently consuming local credential material is risky because it broadens access to preexisting identities and can surprise users of a skill whose stated purpose is only fever analysis.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: HTTP requests attach user identity and authentication tokens and may include tenant and platform metadata, yet there is no user-facing disclosure or consent flow. In the context of a livestock fever-detection skill, this hidden transmission is especially concerning because the advertised function does not imply account enrollment or backend identity propagation.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 90% confidence
• Finding: This code performs an external POST to a health-platform login/registration endpoint, sending openId/mobile/source fields derived from local identity state. The transmission is not inherently malicious, but in this skill it is unrelated to the core image-analysis function and creates an unnecessary outbound identity flow that could expose user or tenant information.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2