Security audit
Security checks for vulnerabilities and agentic risk
The skill is broadly aligned with pet litter-box media analysis, but it silently links requests to an account and handles credentials/media in ways that need review before installation.
Install only after reviewing the backend operator and configuration. This skill uploads or submits media/URLs to remote services, creates or reuses an internal account identity, retrieves cloud history, and stores service tokens locally; the publisher should fix HTTPS-only endpoint selection, credential origin allowlisting, and token storage before normal use.
skills/smyx_common/scripts/config-dev.yaml:2Enabled Development Configuration Transmits Media, Identity Data, and Authentication Credentials over Plaintext HTTP
skills/smyx_common/scripts/dao.py:460Authentication Tokens Are Persisted Unencrypted in a Shared Workspace SQLite Database
skills/smyx_common/scripts/util.py:572Authenticated Request Utility Forwards Credentials to Arbitrary Absolute URLs
skills/smyx_analysis/requirements.txt:3Analysis Dependency Manifest Uses an Inconsistent Package Name for YAML Support
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
The supplied behavior summary indicates the skill reads local workspace identity files, creates directories and default identities, logs into remote services, stores tokens, and handles payment/account flows unrelated to litter-box analysis. This is dangerous because it covertly mixes authentication, identity persistence, and broad backend access into a skill users would reasonably expect to only analyze pet media.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-pet-litter-box-waste-analysis"
description: "Triggers when a user provides a cat litter box area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for waste characteristic recognition, analyzing feces morphology (loose stool, bloody stool, dry hard stool) and urine clump size to identify urinary and digestive system abnormalities, outputting health risk alerts (without diagnosing diseases). Application scenarios: smart litter boxes, multi-cat household health monitoring. Development reason: early signs of urinary diseases, a pain point for multi-cat households. | 当用户
The HTTP helper silently performs phone-login/registration, retrieves tokens, stores them locally, and automatically attaches them to subsequent requests. For a pet waste analysis skill, this is overbroad and dangerous because it can create external accounts and transmit identity/authentication data without an explicit, task-specific need or clear user approval.
The skill declares no explicit tool restrictions even though the manifest instructs use of shell, file access, network access, and environment-dependent behavior. In an agent environment, missing least-privilege scoping increases the blast radius if the skill is invoked unexpectedly or if downstream scripts behave unsafely.
The skill states that local files or URLs are processed by server-side APIs, but it does not present a clear privacy warning about third-party/cloud transfer in the user-facing description. This creates a consent and data-handling risk because users may upload home environment videos without realizing they will be sent off-device.
The auto-trigger phrases for historical report retrieval are broad enough that normal conversation could invoke cloud report listing unintentionally. In a skill that also auto-associates internal identity and directly queries cloud data, overbroad triggers increase the chance of inadvertent disclosure of historical records.
The method returns a fixed Chinese string for the output header, with no indication that the user can choose the language or locale. This can violate language/locale policy when a skill enforces a specific language by default without documented opt-in or justification.
The skill includes a record-listing capability tied to an internal open_id, which goes beyond the stated purpose of analyzing a provided video. If exposed through the agent or invoked in the wrong context, it could reveal prior health-analysis records and associated sensitive behavioral or medical inferences without clear user intent or authorization boundaries.
The manifest describes a skill focused on analyzing cat litter box area videos for feline waste characteristics and related health risks. However, the CLI exposes a pet-type option with values 'cat', 'dog', and 'other', broadening the skill beyond the stated cat-specific scope.
Sensitive identity resolution occurs automatically and without any user-facing notice, which undermines transparency for a health-adjacent monitoring skill. Because the skill handles pet waste analysis that can imply health conditions, undisclosed identity linkage raises privacy risk and can lead to retention or correlation of sensitive data under an internal identifier.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill accepts either a local file or a remote video URL and forwards that user-supplied content to a backend analysis service via self.analysis(...), but this file provides no user-facing notice, consent checkpoint, or minimization control before transmission. In a pet-health monitoring context, uploaded videos may contain sensitive household imagery or metadata, so silent transfer to a server-side service creates a real privacy and data-handling risk even if there is no direct code execution issue.
The skill exposes a history-list retrieval path via show_analyze_list(open_id) that is not described in the stated trigger behavior, expanding functionality from one-shot video analysis into account-linked data retrieval. Undocumented retrieval features increase the risk of unauthorized access to prior analysis records, especially because the call is keyed by user identity and there is no visible authorization check in this file.
The code resolves a hidden open_id context and uses CURRENT__OPEN_ID to fetch account-scoped history without making that identity flow visible to the user. In a pet waste video-analysis skill, silently binding requests to a user identifier is not necessary for the immediate analysis task and creates privacy and cross-account access risk if identity resolution is spoofed, stale, or overly trusted.
The manifest describes a narrowly scoped video-analysis skill for cat litter box waste characteristics. In this file, the shared configuration layer reads external environment variables for sender/open IDs and usernames, which is not an obvious requirement for feces/urine video analysis itself and introduces identity-context access beyond the stated purpose.
This code reads user- and identity-related environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) and uses them to populate runtime state, but there is no confirmation prompt, logging, comment, or docstring disclosing that sensitive environment data is being accessed. For code files, credential or identity-related environment access should have some visible disclosure unless it is clearly documented elsewhere in the skill description, which is not present in this file.
The manifest claims a specific capability: analyzing cat litter box waste videos for health risk alerts. This file embeds a very large enumeration of scene codes spanning human surveillance, infant monitoring, driver monitoring, plant diagnostics, livestock analysis, and many unrelated pet and health scenarios, indicating the skill package carries broad capability-selection infrastructure not justified by the stated single-purpose skill.