ClawHub
Back to skill

Security audit

Cat & Dog Health Diagnostic Analysis Tool | 猫狗宠物健康诊断分析工具

Security checks across malware telemetry and agentic risk

Overview

This pet-analysis skill is mostly coherent, but it silently creates or reuses identity records, stores tokens locally, and can query cloud history without clear user-facing consent.

Review this skill carefully before installing. It sends pet media and identity-linked data to remote services, can create/reuse a default account silently, stores authentication tokens in a local workspace database, and may query prior reports automatically when history-related phrases are used. Install only if you trust the publisher and are comfortable with those data flows and the configured API environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
This method applies filter keys via getattr(self.__model__, key) without validating that the requested field is an allowed ORM column. If untrusted input reaches filters, an attacker can trigger exceptions or query on unintended model attributes, causing information exposure about schema/behavior or denial of service through malformed requests. In the pet-analysis context, a shared DAO used across skills increases the chance that externally influenced parameters could reach this generic listing path.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
The count() method repeats the same unvalidated dynamic model attribute lookup for filter keys. If attacker-controlled filters are accepted upstream, this can be abused to probe model internals, generate server errors, or bypass intended query constraints by using unexpected attributes. Because this skill includes user/account persistence unrelated to pet video analysis, the broader shared-use context makes misuse more plausible.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no explicit permissions while instructing use of shell execution, local file handling, environment-backed identity behavior, and network/API access. This creates a transparency and policy gap: users and hosting platforms cannot accurately assess what the skill can do, increasing the risk of unintended data access, local persistence, or outbound transmission.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script includes undocumented identity resolution via OpenIdUtil.resolve_current_open_id and a hidden --list mode that retrieves a user's analysis history, which expands the skill beyond simple pet-video analysis. In a skill that may process user-supplied files and URLs, hidden access to identity-linked records increases the risk of unauthorized data exposure or privacy violations if invoked by an unintended caller or wrapper.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill implements a report-listing function that can enumerate prior analysis records, which goes beyond the declared purpose of analyzing a single user-provided pet video. In a health-report context, this expands access to potentially sensitive historical data and can expose other users’ report metadata or contents if access control is weak or absent upstream.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
The code generates direct export links for report images, adding a report-export capability not described in the manifest. In this pet health context, exported reports may contain sensitive health inferences or identifying media-derived details, and exposing export URLs can facilitate unintended sharing or access if the links are guessable or insufficiently protected.

Context-Inappropriate Capability

Medium
Confidence
72% confidence
Finding
The script exposes a history-listing function that is outside the user-declared purpose of analyzing a submitted pet video. Undisclosed retrieval of prior analysis history can expand access to stored user data and may leak metadata or results unexpectedly, especially because it is keyed off a resolved current open_id rather than an explicit user-confirmed target.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This service exposes broad generic request primitives and CRUD-style wrappers that can send arbitrary GET/POST/PUT/DELETE requests to caller-supplied URLs, which goes beyond the narrowly described pet-analysis purpose. In a skill that may process user-provided video URLs and invoke server-side APIs, this kind of unrestricted network capability increases the risk of internal API abuse, unintended data access, and SSRF-style misuse if higher-level code passes untrusted or loosely validated endpoints.

Description-Behavior Mismatch

Low
Confidence
87% confidence
Finding
The configuration hard-codes private-network HTTP development endpoints, including an internal RFC1918 address, for services the skill can call. In a skill that accepts user-supplied video URLs/files and invokes server-side APIs, this increases the risk of accidental connection to non-production/internal systems, data leakage, insecure transport, and misuse of an agent as a bridge into internal network resources.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The model stores identity fields and authentication-related token data (token, open_token) in a local SQLite database without any visible encryption, minimization, retention controls, or clear linkage to the pet-analysis function. If the workspace or database file is exposed, these secrets and personal identifiers could be harvested for account compromise or privacy abuse. In this skill context, collecting auth data is more dangerous because it is not obviously necessary for analyzing pet videos.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This utility provisions, resolves, and persists user identities and tokens in local workspace state even though the skill is presented as a pet video analysis tool. That is a scope mismatch: users providing pet media would not reasonably expect hidden identity creation, reuse, and token persistence, which increases privacy and account-abuse risk across sessions.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The HTTP helper can silently call a phoneLogin endpoint with register=1 and silent=1, effectively creating or logging into accounts without a user-facing authorization step. In the context of a pet analysis skill, this exceeds expected functionality and could be used to provision identities, associate user input with backend accounts, and persist access tokens without informed consent.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-report trigger uses broad keyword matching that can automatically invoke cloud report retrieval based on vague phrases. In a multi-turn or ambiguous conversation, this can cause unintended access to prior report metadata tied to an internal identity without clear, fresh user confirmation.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default trigger activates whenever a user provides a pet video URL or file for analysis, but the scope is broad and can fire on loosely related content. Overbroad activation increases the chance that files are automatically processed, saved locally, or sent to backend services without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill states that uploaded attachments or media files are automatically saved locally, but this behavior is not surfaced as a clear user-facing warning at trigger time. Silent local persistence of user-provided media is a privacy and security risk, especially for sensitive personal or household content.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The --list behavior and internal open_id handling are not disclosed in normal help output, making it difficult for users or integrators to understand that the tool can access identity-associated history. Hidden capabilities are dangerous because they bypass informed consent and can be abused to enumerate or retrieve prior pet health analyses tied to a user identity.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The tool accepts hidden API-related parameters and sends user-supplied video input to an external analysis service without any visible warning, consent flow, or transport/data-handling disclosure. In a pet-health context, users may reasonably expect local or narrowly scoped processing, so silent transmission of videos and credentials increases privacy and secret-handling risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This request path transmits identifiers and authentication material to remote services and can also trigger automatic registration, yet there is no visible user-facing warning or consent flow in the code path. For a pet video analysis skill, hidden transmission of account-linked data materially increases privacy risk and makes backend actions hard for users to understand or control.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
This line sends user-derived identity data to an external phoneLogin endpoint. External transmission is especially sensitive here because the skill's stated purpose is pet health analysis, not account provisioning, so the network call introduces unexpected data sharing and backend identity creation risk.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供健康参考，不能替代专业宠医诊断 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |
Confidence
82% confidence
Finding
The finding indicates hidden or non-obvious instructional content embedded in the skill document, which is risky because concealed directives can manipulate agent behavior without transparent review. In this skill, hidden formatting around operational instructions could obscure how report links are derived or how network resources are handled, complicating auditability and increasing prompt-injection style risk.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "pet-analysis"
description: "Triggers when a user provides a video URL or file of a pet (cat/dog/bird) for analysis; supports local video uploads or network URLs to call server-side APIs for health checks, analyzing features like fur, body, and face to identify potential diseases and generate a Pet Safety Guardian health report. | 猫狗宠物健康诊断分析工具，当用户提供猫/狗/鸟等宠物的视频 URL 或文件需要分析时，触发本技能进行宠物健康诊断分析；支持通过上传本地视频或网络视频 URL，调用服务端 API 进行宠物健康检查，分析毛发、身体、脸部等特征，识别潜在疾病并输出宠安卫士健康报告"
license: "MIT-0"
---
Confidence
78% confidence
Finding
The manifest contains metadata patterns associated with tool/skill poisoning, and the skill description is unusually instruction-heavy for activation behavior. Because agents often trust manifest metadata to decide when and how to invoke tools, poisoned or overloaded metadata can bias routing, trigger overreach, and enable unintended access to files, network resources, or historical reports.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2