Back to skill

Security audit

Smart Feeder Pet Detection & Recognition Skill | 智能喂食器宠物检测识别技能

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for cloud-based pet-camera analysis, but it silently creates or reuses an identity and stores service tokens locally, so it needs user review before installation.

Install only if you are comfortable with pet-camera images or videos, supplied URLs, account-linked report history, and generated identity values being sent to LifeEmergence-hosted APIs. Review the local workspace data directory because the skill may create a SQLite database and cache service tokens there; avoid using sensitive signed URLs or private household footage unless that cloud handling is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
76% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises significant capabilities—shell execution, network access, environment access, and file read/write—yet declares no permissions or user-facing trust boundaries. This makes the operational scope opaque and increases the chance that an agent executes local commands, stores files, or sends data to remote APIs without informed consent or policy enforcement.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The documented APIs are for pet health analysis and report export, which do not match the skill’s stated purpose of pet detection and identity recognition. This kind of capability mismatch is dangerous because it can mislead reviewers and users about what data is being processed and what backend actions the skill may perform, increasing the risk of unauthorized data collection or invocation of unrelated sensitive functions.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The CLI initializes an internal user identity via OpenIdUtil.resolve_current_open_id and exposes a hidden --list capability that retrieves analysis history tied to ConstantEnum.CURRENT__OPEN_ID, even though the skill is presented as a pet detection/enrollment tool. This creates undisclosed access to user-associated remote data and expands functionality beyond the declared purpose, increasing the risk of privacy violations or unauthorized history access if identity resolution is overly broad or implicit.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The methods `http_post`, `http_put`, `http_get`, and `http_delete` expose a generic arbitrary HTTP client surface that is not constrained to pet detection or feeder-camera analysis. In a skill intended for computer-vision pet recognition, this broader network capability can be repurposed to contact unexpected endpoints, exfiltrate data, or perform unrelated actions if higher-level code passes attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The `add`, `edit`, and `delete` helpers forward arbitrary requests to caller-supplied URLs and arguments, enabling generic remote state changes unrelated to the stated vision-analysis purpose. In the context of a pet-detection skill, these broad mutation primitives increase the attack surface and could be abused to modify or delete remote resources if exposed through agent workflows or untrusted inputs.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
This file defines generic user-account persistence, including username/realname lookup and default-user selection, which is not clearly necessary for a pet-detection feeder skill. Scope expansion increases attack surface and creates opportunities for unnecessary collection and retention of personal data in a skill whose declared function is animal recognition.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The model stores token and open_token values even though token storage is not justified by the stated pet-recognition use case. Persisting authentication material in a local SQLite database expands the consequences of local file disclosure or improper access controls, potentially exposing credentials or session tokens.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
This utility layer performs remote login/account bootstrap, token retrieval, token caching, and authenticated outbound API calls, which is materially broader than the pet-detection skill's stated computer-vision purpose. In this context, hidden account provisioning and backend access increase the risk of undisclosed data exfiltration, unexpected remote actions, and privilege misuse under a seemingly unrelated skill.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code detects agent workspace context from environment variables and filesystem layout, then uses that context to access shared workspace data. In a pet-detection skill, this expands scope into environment discovery and local identity-material access that is unrelated to CV functionality and increases the blast radius if the skill is abused or repurposed.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The request wrapper contains balance/payment failure handling and instructs users to install and use a payment skill, which is unrelated to pet recognition. Embedding monetization/account workflows in a low-level utility is risky because it hides non-obvious business logic and can steer users into additional actions outside the declared skill purpose.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-report trigger phrases are broad enough that ordinary conversational requests could unintentionally invoke cloud history retrieval. In this skill, that could expose prior pet recognition reports linked to an internal identity context without a sufficiently deliberate user action.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that uploaded attachments and media files are automatically saved locally, but it does not clearly warn the user before doing so. Automatic local persistence of images and videos can create privacy, retention, and filesystem exposure risks, especially for camera feeds from homes.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill routes network URLs and history queries through a cloud API but does not provide a clear privacy warning that user media, metadata, and report queries may be transmitted to a remote service. Because the content includes feeder/IPC camera imagery and identity-linked pet records, undisclosed cloud transfer materially raises privacy and data-governance risk.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The API doc explicitly supports file upload and full report export but provides no warning or constraints around sensitive data handling, retention, access control, or privacy implications. In a pet-camera/feeder context, uploads and exports may contain images, health information, or owner-associated data, so undocumented handling increases the chance of privacy breaches or overbroad data exfiltration.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
analyze_media forwards a local file path or URL to skill.get_output_analysis for remote processing, but the user-facing flow does not clearly disclose that media content may be transmitted off-device to an API-backed service. Because pet feeder/IPC media can contain sensitive household imagery, undisclosed network transfer creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
show_analyze_list queries remote analysis history using an OpenID-derived identifier without clear user disclosure that account-linked data is being looked up. Combined with hidden identity initialization in main, this can silently enumerate or expose user-associated records, which is especially sensitive in a camera-based smart-home context.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads an arbitrary local file and packages its raw contents for upload to the backend analysis API, but this file contains no user-facing disclosure or consent flow indicating that local media will be transmitted off-device. In a camera/feed analysis context, uploaded videos may contain pets, people, homes, or other sensitive environmental data, making silent transfer a meaningful privacy and data-governance risk.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill accepts remote video URLs and forwards them to the analysis service without any visible notice that the URL itself will be transmitted to an external backend. While less severe than direct local-file upload, this still creates a privacy and transparency issue because URLs may embed tokens, internal hostnames, or other sensitive identifiers.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script accepts a local file path or remote URL and sends it to `skill.get_output_analysis(...)`, which likely invokes an external service, yet the user-facing flow does not clearly warn that video content may leave the local environment. In a pet-feeder/IPC context, uploaded videos can contain household interiors, people, routines, and other sensitive data, so silent transmission creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code reads an identity value from data/smyx-api-key.txt and later uses it to resolve the current open-id for authenticated requests, without any visible user disclosure in this file. Silent consumption of workspace-stored identity material creates a credential misuse risk and may cause actions to be performed under a user identity the operator did not knowingly authorize.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This code automatically sends user-related identifiers such as openId/mobile and may silently register or log in a remote account. In the context of a pet-detection skill, that is especially concerning because it creates undisclosed identity linkage and outbound data transmission unrelated to the user-visible CV function.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:视频支持 mp4/avi/mov 格式,图片支持 jpg/png/jpeg 格式,最大 10MB |
| 🔎 使用提醒 | 适用于喂食器、IPC摄像头等固定视角场景,检测准确率更高 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供智能喂养参考,不能替代人工确认 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📁 格式支持 | 当显示历史检测报告清单的时候,从数据 json 中提取字段  作为超链接地址,使用 Markdown 表格格式输出,包含" |
Confidence
88% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2