Back to skill

Security audit

Pet Body Condition Score 3D Analysis | 宠物体态3D评分(BCS)

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for pet body-condition video analysis, but it also silently creates or reuses an identity, stores account tokens locally, and can query cloud history, so it needs user review before installation.

Install only if you are comfortable sending pet media or supplied media URLs to lifeemergence.com/open.lifeemergence.com services, linking requests to an automatically managed identity, and keeping service tokens in a local workspace SQLite database. Avoid using private/internal URLs or sensitive household videos unless the publisher provides clearer consent, retention, and account-management controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
72% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
72% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises and operationally requires file read/write, shell execution, network access, and likely environment access, yet it declares no explicit permissions. This creates a transparency and policy-enforcement gap: users and hosting platforms may not realize the skill can persist files locally, invoke scripts, and send user-provided media/URLs to external services.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The documented endpoints go beyond the declared skill purpose of Body Condition Score analysis and include generic health-analysis workflows plus full report export. This scope mismatch can enable over-collection, broader data access, or unintended invocation of sensitive reporting functions if downstream components trust the docs or wire these endpoints into the skill without stricter authorization and purpose limitation.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script exposes a `--list` mode that retrieves prior analysis records via `skill.get_output_analysis_list(open_id=open_id)`, but this capability is not reflected in the stated skill purpose, which only describes analyzing user-provided pet videos. Hidden or undocumented history access increases the risk of unauthorized data exposure, especially because the records are keyed to an internal identity and may reveal prior user submissions or health-related observations.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code initializes an internal `open_id` through `OpenIdUtil.resolve_current_open_id(...)` even though the declared function of the skill is only video-based body condition analysis. Introducing hidden identity resolution expands data collection beyond the advertised purpose and creates a linkage between uploaded pet media and a persistent user identifier, which can enable profiling, history access, or cross-session tracking without clear disclosure.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script exposes a `--list` mode that retrieves account-scoped analysis history via `skill.get_output_analysis_list(open_id=open_id)`, but the declared skill purpose is limited to analyzing submitted pet videos. Adding undisclosed history enumeration broadens data access beyond user-expected behavior and can expose prior analysis records if invoked through the agent or by another component.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code silently resolves a hidden `open_id` using `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` and then uses `ConstantEnum.CURRENT__OPEN_ID` for account-scoped history access. Hidden identity resolution for non-obvious account operations increases the risk of unauthorized data access, cross-context confusion, and privacy violations because the user is not clearly informed that their identity is being bound to history retrieval.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This service exposes broad generic CRUD and arbitrary HTTP wrapper methods (`http_get`, `http_post`, `http_put`, `http_delete`, plus generic `add/edit/delete/page/list`) that are not constrained to the stated pet body-condition scoring purpose. In a skill that should only process pet media and call specific analysis APIs, these wrappers expand the reachable network/API surface and can enable unintended backend actions, data access, or misuse if higher-level code passes attacker-influenced URLs or parameters.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
A shared user/account persistence layer is outside the stated purpose of a pet body-condition analysis skill, which should mainly process pet media and return observational results. Unrelated account storage expands the data collection surface and creates unnecessary privacy and security risk, especially because the DAO is generic and reusable across contexts.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The model stores token and open_token fields even though the skill is described as non-diagnostic pet observation. Storing authentication-like secrets in a local SQLite database materially increases compromise impact, because database theft would expose reusable credentials or session artifacts unrelated to the skill's core function.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility creates, resolves, and persists user identities and tokens locally even though the advertised skill is pet body-condition video analysis. That expands the data-handling scope beyond user expectations and can silently bind workspace activity to a generated or recovered identity, increasing privacy risk and unauthorized account linkage risk.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The HTTP helper can silently call /sys/phoneLogin with register=1 and silent=1 to create or log in users against a health service using a derived username/openId. For a pet-analysis skill, this is unrelated hidden account activity and could cause undisclosed registration, identity correlation, and backend account creation without informed user action.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The overview says the skill supports local uploads and network URLs for server-side analysis, but it does not clearly warn users that submitted local files and remote URLs are transmitted to a backend API. That omission can lead to unintended disclosure of sensitive media, metadata, or internal-only URLs if a user assumes analysis is local.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments or media files are automatically saved as local files, but it does not warn users about local persistence or handling of those files. Silent local storage increases the risk of sensitive data lingering on disk, being accessed by other components, or being included in backups/logs without user awareness.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill accepts either a local file path or an arbitrary HTTP(S) URL and forwards the video content to a backend analysis service, but this code shows no explicit user-consent prompt, privacy notice, or restriction on what remote URLs may be fetched. Because pet videos may contain sensitive household imagery or metadata, silent transmission to a server can cause privacy and data-handling risks; accepting arbitrary URLs also increases SSRF risk if the backend later retrieves attacker-controlled internal URLs.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The tool tells the user it is analyzing a video, but does not clearly disclose that local files or supplied URLs may be transmitted to a remote service through `skill.get_output_analysis(...)`. Because pet videos can contain sensitive household, location, or personal information, silent external transmission creates a meaningful privacy and consent risk in this skill context.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads an identity value from data/smyx-api-key.txt and reuses it as an internal open-id without any visible notice or confirmation. This can unexpectedly appropriate a workspace-scoped secret or identifier for remote account association and makes identity use opaque to operators.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request helper automatically attaches identity and authorization material (App-Id, X-Access-Token, X-Api-Key, Authorization, pnaUserName) and transmits it to remote services. In a skill advertised for pet-video scoring, undisclosed transmission of auth and identity data is more dangerous because it exceeds the user's expected data flow and can expose credentials or enable account tracking across services.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 🧑‍⚖️ 结果性质 | 分析结果仅供体重管理参考,不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 🧑‍⚖️ 结果性质 | BCS 评分基于视觉特征估算,可能与触诊评分存在偏差,建议结合兽医实际触诊作为最终参考 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
| 📜 报告输出 | 表格输出示例 |
Confidence
80% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-body-condition-score-3d-analysis"
description: "Triggers when a user provides multi-angle pet videos (standing/side/top-down view) URL or files for analysis; supports local video uploads or network URLs to call server-side APIs for 3D body shape reconstruction and Body Condition Score (BCS, 1-9) evaluation, classifying body type as underweight, ideal, or overweight/obese, outputting standardized observation data (without diagnosing diseases or prescribing treatment). Application scenarios: smart feeders, pet cameras, pet health management platforms. Development reason: early warning for obesity-related diseases, scientific weight management. | 当用户提供宠物多角度视频(站立、侧身、俯视)的URL或文件时,触发本技能进行3D体型构建与BCS体况评分;支持通过上传本地视频或网络视频URL,调用服务端API进行体态分析,自动评估体况评分(1-9分),判断偏瘦、正常或肥胖,输出标准化体态观察结果(不诊断疾病、不提供治疗建议)。应用场景:智能喂食器、宠物摄像头、宠物健康管理平台。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
87% confidence
Finding
description:; ‍; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2