Security audit
Security checks for vulnerabilities and agentic risk
This skill is a cloud livestock-analysis wrapper, but it also silently creates or reuses an identity and stores service tokens locally, so users should review it before installing.
Install only if you are comfortable sending livestock media and report-history requests to the configured lifeemergence.com services and allowing the skill to create or reuse a local identity with persisted service tokens. Prefer explicit confirmation before history lookups, and review or clear the workspace data database if shared machines or sensitive farm records are involved.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
The combined behaviors—external API calls, auth header handling, local file writes, workspace detection, user identity creation/retrieval, and generic polling helpers—represent a much broader operational footprint than the manifest suggests. This is dangerous because it creates covert data movement and state persistence pathways in a skill users would reasonably assume is a simple media-analysis wrapper.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-livestock-individual-analysis"
description: "Identifies individual livestock (pigs, cattle, sheep) by facial or body-pattern features and outputs a stable individual ID with confidence for precision farm management and tracking. | 通过面部/体纹识别畜禽个体，实现精准管理追踪。"
version: "1.0.15"
license: "MIT-0"
---
# 🐄 Livestock Individual Identification & Tracking | 畜禽个体识别与追踪
> 通过面部/体纹识别畜禽个体，实现精准管理追踪。
>
> **精准养殖识别中枢** · 面部/体纹智能比对 · 个体身份识别 · 追踪管理 · 历史报告云端查询
---
##
The manifest says the skill identifies individual pigs, cattle, or sheep and returns a stable individual ID with confidence. In this file, the main analysis path accepts a local or remote video input, uploads it under a generic 'file'/'videoUrl' parameter, and returns generic 'analysis report' content without any livestock-specific logic or extraction of stable IDs/confidence fields.
The implementation does not align with the advertised livestock-identification purpose and instead acts as a generic video-analysis/history-list client. This kind of capability mismatch is dangerous because users may grant trust, data, or permissions based on the declared purpose, while the code can send arbitrary local paths or remote URLs to backend analysis functions and enumerate prior analysis history via open_id.
This utility layer creates and persists platform user identities and reuses them as a hidden default execution context, which is unrelated to livestock identification. That behavior can silently bind skill activity to an undisclosed account, create unauthorized records, and enable downstream API actions under credentials the user never explicitly approved.
The HTTP helper performs login/registration, token bootstrap, token refresh retries, and local token persistence as part of ordinary request flow, far beyond the skill's declared purpose. In this context, the skill can silently authenticate to external services and operate under provisioned identities, increasing the risk of covert account usage, data exfiltration, and unauthorized API access.
The skill declares no explicit tool or permission scope even though the manifest instructs use of shell execution, network access, local file handling, and likely environment-backed identity/config resolution. In an agent setting, missing least-privilege boundaries increases the chance that the skill can be invoked with broader capabilities than users expect, especially because it also saves files locally and queries remote services.
The automatic history-query trigger phrases are broad enough that common user language could unintentionally invoke cloud-side report listing. Because report listing is identity-linked and accesses historical data, accidental triggering can expose more information than the user intended to request.
The example keyword list for auto-triggering history/report listing is vague and open-ended, which can normalize over-eager invocation behavior in implementations. In a skill that accesses prior records, ambiguous triggers increase privacy and authorization risk through unintended retrieval of historical reports.
The user-facing output header is hard-coded in Chinese ("畜禽个体识别与追踪结构化结果") with no indication that the skill is region-specific or that users can choose their preferred language. This creates a natural-language locale policy issue because the skill imposes a specific language without opt-in.
The parser description and help text say this tool performs livestock individual recognition and tracking, yet the very next argument definition constrains the species/category to pet-oriented values. That is an active contradiction in the file's own documentation and interface semantics, not merely an omitted detail.
The manifest specifically describes identifying individual livestock, but the exposed interface only accepts pet-type values of cat, dog, and other. This is a semantic mismatch between the advertised livestock-focused capability and what the code actually presents and configures at runtime.
The script silently resolves and initializes an internal identity via OpenIdUtil.resolve_current_open_id using a hidden parameter and without clear user disclosure. In a tracking/analysis skill, implicit identity binding can cause actions, history retrieval, or data association to occur under an unintended user context, creating privacy and authorization risks if records are segregated by open_id.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response