Pet Body Condition Score 3D Analysis | 宠物体态3D评分（BCS）

• Outcome: Review
• Latest audit: Oct 13, 2026 · 2:20 PM UTC
• Version: 1.0.12

Overview

The skill does the advertised cloud pet-video analysis, but it also silently creates or reuses an identity, stores login tokens locally, and can retrieve cloud history, so it should be reviewed before installation.

Install only if you are comfortable with pet videos or video URLs being sent to the configured Life Emergence services and with the skill silently creating or reusing an internal identity, logging in/registering against the backend, storing tokens in a workspace SQLite database, and querying cloud history. Prefer an isolated workspace and remove local data such as smyx-common-claw.db or smyx-api-key.txt if you do not want cross-run identity reuse.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes a broad set of concealed behaviors: local workspace inspection, environment-based context detection, persistent default identity generation, local database access, automatic remote registration/login, token management, and generic HTTP client actions. Combined with a benign-looking pet-analysis description, this strongly suggests a deceptive capability set that could harvest data, create shadow identities, and communicate with remote services without informed authorization.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

A YARA hit for tool/metadata poisoning indicators in a skill manifest is a serious red flag because agent systems often trust manifest metadata for routing, triggering, and tool selection. Even if the visible text looks benign, poisoned metadata can be used to influence orchestration behavior, conceal real capabilities, or manipulate downstream parsers and reviewers.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-pet-body-condition-score-3d-analysis"
description: "Triggers when a user provides multi-angle pet videos (standing/side/top-down view) URL or files for analysis; supports local video uploads or network URLs to call server-side APIs for 3D body shape reconstruction and Body Condition Score (BCS, 1-9) evaluation, classifying body type as underweight, ideal, or overweight/obese, outputting standardized observation data (without diagnosing diseases or prescribing treatment). Application scenarios: smart feeders, pet cameras, pet health management platforms. Development reason: early warning for obesity-related diseases, scientific wei

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The utility automatically creates or logs in platform user accounts, retrieves tokens, and persists them locally as part of generic HTTP request handling, even though the skill is presented as pet body-condition video analysis. This introduces hidden identity provisioning and credential management behavior unrelated to the declared function, enabling undisclosed account creation and backend access under derived identities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code sends openId, mobile, and source fields to a remote login/registration endpoint automatically, with 'silent' and 'register' enabled, and without visible consent or disclosure. This is dangerous because it transmits identity data and may create remote accounts behind the user's back, which is far outside normal expectations for a pet body-scoring skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises behavior that requires filesystem, network, environment, and shell access, but the manifest does not declare any explicit tool scope or permission boundaries. In an agent setting this increases the chance of over-privileged execution, making unintended file access, command execution, or network requests harder to govern and review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that uploaded local files are automatically saved locally and that supplied URLs are sent to server-side APIs, but it does not clearly present these data-handling consequences as a user-facing warning. Because the content involves user-provided media, insufficient disclosure creates privacy and consent risk and can lead to inadvertent transmission or retention of sensitive data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented endpoints go beyond the stated purpose of body-condition scoring and include generic health-analysis workflows, history pagination, and full report export. This scope mismatch increases the risk that the skill can access or expose broader pet-health data than users or reviewers expect, enabling over-collection, unauthorized report retrieval, or privacy leakage if those capabilities are wired into the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script exposes a --list mode that retrieves prior analysis records via skill.get_output_analysis_list(open_id=open_id), but this capability is not part of the declared skill purpose of analyzing supplied pet videos. Hidden or undocumented data-listing features increase the risk of unauthorized access to historical user data, especially because the identity used to scope results is internally resolved rather than explicitly user-provided and consented.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code initializes and relies on an internal open_id (OpenIdUtil.resolve_current_open_id(...) and ConstantEnum.CURRENT__OPEN_ID) even though the skill's stated function is only video-based body-condition analysis. Introducing hidden identity resolution creates unnecessary collection and coupling of user identity to analysis operations, and when combined with the listing feature it can expose or correlate prior analyses without transparent user awareness.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill accepts either a local file path or an arbitrary remote URL and forwards the video content to a backend analysis API, but this code shows no explicit consent prompt, trust boundary check, or restriction on which remote sources may be fetched. In a skill handling user-provided media, this creates privacy and data-handling risk because sensitive local files or third-party-hosted videos could be transmitted off-box without a clear user-facing warning or policy enforcement in this layer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python file contains multiple user-facing strings in Chinese, including argument descriptions and runtime error/status messages. Because the skill does not offer a language selection or document a justified locale restriction, it risks violating language/locale policy by forcing a specific language on users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script exposes a --list mode that retrieves historical analysis records via skill.get_output_analysis_list(open_id=open_id), which is outside the manifest’s stated purpose of analyzing user-supplied pet videos. This creates an unnecessary data-access surface and could enable disclosure of prior users’ analysis metadata or results if CURRENT__OPEN_ID resolution or authorization checks are weak elsewhere in the stack.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This service exposes broad generic HTTP/CRUD helper methods (page/add/edit/delete/http_get/http_post/http_put/http_delete) that are not constrained to the stated pet body-condition analysis workflow. In a skill that should only process pet video inputs and call specific backend analysis endpoints, these wrappers create unnecessary capability expansion and could be reused by other code paths to access unintended internal or external services, increasing the attack surface for SSRF-like misuse, data exfiltration, or unauthorized API actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level docstring is entirely in Chinese and does not indicate that other languages are supported or that the locale is intentionally restricted. The policy requires avoiding language or locale constraints unless the skill offers choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring at L25-L35 states that the method calls the openclaw agent through subprocess. However, the subprocess import and run invocation are commented out at L4 and L61-L66, the command list is empty at L48-L55, and the code substitutes result with an empty dict at L68. This is an active contradiction between the documented intent and actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2