Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its pet health analysis purpose, but it silently creates or reuses a user identity, stores auth tokens locally, and sends media or URLs to a cloud API, so it needs review before installation.
Install only if you are comfortable sending pet media or video URLs to the configured cloud service and allowing the skill to create or reuse a local identity with stored auth tokens for later report lookup. Avoid submitting videos that reveal sensitive household, location, or owner information unless that cloud processing and local token persistence are acceptable.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The finding indicates the skill may read local credential material, create or reuse default identities, persist users, and perform generic authenticated HTTP requests unrelated to pet-video analysis. This is dangerous because hidden credential handling and automatic identity reuse can enable unauthorized API use, cross-user data exposure, and covert exfiltration under cover of a benign workflow.
The YARA hit for metadata poisoning indicators suggests the manifest may contain suspicious formatting or schema content intended to influence tooling or reviewers. While the evidence here is weak and the matched snippet is limited, metadata-level manipulation is relevant because agents often trust skill manifests to determine behavior and safety posture.
---
name: "pet-analysis"
description: "Triggers when a user provides a video URL or file of a pet (cat/dog/bird) for analysis; supports local video uploads or network URLs to call server-side APIs for health checks, analyzing features like fur, body, and face to identify potential diseases and generate a Pet Safety Guardian health report. | 猫狗宠物健康诊断分析工具，当用户提供猫/狗/鸟等宠物的视频 URL 或文件需要分析时，触发本技能进行宠物健康诊断分析；支持通过上传本地视频或网络视频 URL，调用服务端 API 进行宠物健康检查，分析毛发、身�
The skill advertises and instructs use of shell execution, local file handling, network access, and environment-dependent behavior, but declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance of over-broad tool access and unintended execution paths, especially because the skill explicitly tells the agent to run local Python commands and interact with remote APIs.
The description states the skill 'default triggers' whenever a user provides a pet video URL or file for analysis, and also references broad health-related keywords. It does not clearly define boundaries, non-trigger cases, or whether casual sharing of a pet image/video without a request should activate the skill.
The skill says it will automatically trigger history report lookup when the user mentions phrases like '查询历史报告' or '显示所有宠物报告'. These are broad natural phrases without exclusion conditions or contextual limits, so ordinary discussion about reports could unintentionally invoke the skill action.
The tool accepts remote video URLs and forwards them into server-side analysis (skill.get_output_analysis) without any explicit consent or warning about network retrieval and possible transmission of user-provided media/metadata. In a pet health context, uploaded media may still contain sensitive household, location, or owner information, so silent remote processing raises privacy and data-handling risks.
The CLI exposes a listing mode (--list) tied to show_analyze_list(open_id) and also supports a hidden --open-id parameter, which is unrelated to the core task of analyzing a supplied pet video. This creates an internal data-access capability that could let a caller enumerate or retrieve another user's analysis history if downstream authorization is weak or missing.
The script initializes internal identity via OpenIdUtil.resolve_current_open_id without clear user disclosure, while also hiding the relevant CLI argument from help output. Hidden identity handling obscures security-sensitive behavior and may cause actions or data access to occur under an unexpected account context.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Several user-facing strings are fixed in Chinese, such as the report heading and export-link text, with no evident language selection or opt-in mechanism. This creates a locale/language policy issue because the skill appears to impose one language regardless of user preference.
The fallback output ⚠️ 暂无分析结果 is a user-facing message presented only in Chinese. Without an explicit language choice or documented region-specific scope, this is a natural-language policy violation.
Errors such as missing file, permission denial, unsupported format, oversized file, and missing input are all surfaced in Chinese. Because these are user-visible failure paths and there is no opt-in or locale handling, the skill forces a specific language.
This code transmits either a local file's full contents or a user-supplied remote video URL to a backend analysis service via self.analysis(...), but this file contains no user-facing notice, consent flow, or trust boundary warning before exfiltrating potentially sensitive pet-owner media. Because remote URLs are accepted directly, users may also unknowingly cause the service to fetch third-party resources, creating privacy and network-trust concerns beyond simple local processing.
The report list heading and empty-state message are emitted only in Chinese, again indicating the skill enforces one language in user-facing output. No language-selection mechanism or documented locale restriction is present in this file.
This module exposes broad generic CRUD and arbitrary HTTP wrapper methods (http_get/http_post/http_put/http_delete, add/edit/delete/list/page) that are not constrained to the stated pet-video health-analysis purpose. In a skill that processes user-supplied video URLs and files, such unrestricted request helpers can be repurposed by other skill code to access unintended internal or external endpoints, increasing the risk of SSRF-like misuse, privilege expansion, and unauthorized backend interactions.
The pet-analysis manifest describes analyzing pet videos and generating a health report, but this file also reads messaging/platform identity environment variables such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID. Accessing cross-platform user identity context is not an obvious requirement for pet health video analysis itself and expands capability beyond the stated purpose.
Detected: suspicious.install_untrusted_source