ClawHub
Back to skill

Security audit

Cat Litter Box Waste Characteristic Recognition Tool | 宠物猫砂盆排泄物性状识别

Security checks across malware telemetry and agentic risk

Overview

The skill does the advertised cloud pet-waste analysis, but it also silently creates or reuses an account identity and stores service tokens locally.

Review before installing. Use it only if you are comfortable sending litter-box media or URLs and report metadata to LifeEmergence cloud services, and with the skill creating or reusing a workspace identity and storing service tokens in a local SQLite database. Avoid shared workspaces or sensitive local files unless those identity and retention behaviors are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill manifest describes behaviors that require shell, file read/write, environment access, and network access, yet it declares no corresponding permissions or user-visible consent boundaries. This creates a transparency and policy gap: the agent may handle local files and send data to remote services without an explicit permission model, increasing the risk of unintended data exposure or overbroad execution.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The script exposes a historical analysis listing function keyed by open_id, which is outside the stated trigger-and-analyze workflow and suggests access to stored user-associated results. Because identity initialization is handled internally and the feature is not clearly disclosed, this increases the risk of unauthorized or unexpected retrieval of another user's analysis history if open_id resolution or authorization is weak upstream.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill implements a report-listing capability that is broader than the manifest’s described trigger-and-analyze behavior. This can expose historical analysis records and report metadata beyond the user’s immediate request, creating an authorization and privacy-risk surface if the platform invokes this method or if access controls are weak elsewhere.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This service exposes broad generic HTTP and CRUD wrappers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, `page`, `list`) that are not constrained to the litter-box waste analysis use case. In a skill that accepts user-provided video URLs/files and is supposed to perform a narrow analysis task, such reusable network primitives expand the attack surface and can be repurposed by other skill logic to reach arbitrary internal or external endpoints, enabling abuse such as unauthorized API access or SSRF-style behavior if upstream inputs are not tightly validated.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This file defines persistent local user-account storage, including personal profile fields, inside a skill whose stated purpose is cat litter box waste video analysis. That kind of unrelated identity persistence increases data collection scope, creates unnecessary privacy exposure, and expands the blast radius if the workspace or database is accessed by other components.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The model stores token and open_token values even though the skill is described as analyzing litter-box waste characteristics, not performing authentication or account federation. Persisting authentication-like secrets without clear necessity creates a high-value target for theft, misuse across services, and silent account linkage beyond the skill's declared function.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility code silently resolves, creates, and persists user identities and tokens in local workspace state even though the declared skill purpose is litter-box waste video analysis. That creates hidden identity management behavior and durable account linkage unrelated to the user-visible function, increasing privacy risk and enabling unnoticed cross-session tracking or credential reuse.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The HTTP helper performs implicit account lookup, registration, token refresh, and local persistence as a side effect of ordinary requests. For a pet-health analysis skill, this is significantly overbroad behavior because simply invoking analysis may trigger account creation and authentication flows without explicit user action or disclosure.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill supports uploading local files and submitting remote URLs to a server-side API, but the description does not clearly warn users that their provided files/URLs and derived analysis data are transmitted to cloud services. This undermines informed consent and can expose sensitive household imagery, metadata, or report history to external systems without adequate notice.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code initializes an internal open_id implicitly and hides the parameter from normal help output, reducing transparency around which user identity is being used. In a skill that can retrieve stored analysis history, hidden identity handling can enable confused-deputy or privacy issues if the resolved identity does not match the active user expectation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code reads arbitrary local file contents and uploads them to a server-side analysis API without any user-facing disclosure or confirmation in this file. In a privacy-sensitive health-monitoring context, that increases the risk of unintentionally transmitting sensitive local media or wrong-file selections to a remote service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads a sensitive workspace credential/identity file and uses its contents as an internal identity source without any user-facing disclosure. This can cause users or operators to unknowingly have local secrets repurposed for remote account identification, especially in shared or multi-agent workspaces.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The helper automatically sends identity data such as openId/mobile/source to a remote login endpoint without a user-facing warning or consent prompt. Hidden transmission of identifying information is a privacy and transparency issue, and it is more concerning here because the skill advertises video-based pet health analysis rather than account enrollment.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2