Pet Restricted Area Alert Skill | 宠物禁区预警技能

• Outcome: Review
• Latest audit: Aug 24, 2026 · 8:20 AM UTC
• Version: 1.0.13

Overview

The skill’s pet-video analysis purpose is mostly coherent, but it silently creates or reuses a cloud-linked identity, stores auth tokens locally, and sends private media/account data to external services with limited user control.

Review this skill before installing. It is suitable only if you are comfortable sending pet-monitoring images/videos or URLs to the lifeemergence cloud service and allowing the skill to silently create or reuse an account identity, store returned tokens in a local workspace database, and retrieve cloud report history. Avoid using it with sensitive household footage unless the publisher clarifies retention, token storage, account creation, and deletion controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 79% confidence
• Finding: This query builder applies getattr(self.__model__, key) to caller-supplied filter keys without an allowlist. An attacker who can influence filters may trigger access to unintended model attributes or crash the operation with invalid attribute names, creating an input-driven query surface that is broader than intended.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 79% confidence
• Finding: Like the list() method, count() accepts arbitrary filter keys and resolves them dynamically on the model. If untrusted input reaches this API, it can cause unintended attribute access or denial-of-service via repeated invalid requests, and it unnecessarily expands the query interface for a skill that should not need generic account querying.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs use of shell execution, local file read/write, environment-derived identity handling, and network access, yet declares no permissions. That mismatch can hide the true privilege needs of the skill from reviewers and users, making it easier to run code that accesses local data, persists files, or contacts remote services without transparent consent.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file documents pet health analysis and report export APIs, which materially contradicts the skill's declared purpose of restricted-area and pet behavior warning monitoring. This kind of scope mismatch is dangerous because it can conceal undeclared capabilities, confuse reviewers and operators, and enable collection or exposure of unrelated sensitive pet data under a misleading skill identity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented behavior centers on health analysis jobs, historical reports, and report export rather than intrusion or trash-can/table behavior alerts. In the context of a home monitoring skill, this discrepancy increases risk because users may grant permissions or upload data for one purpose while the skill is actually wired to a different analysis/reporting workflow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill exposes a user-specific analysis history listing function via `show_analyze_list(open_id)` even though the manifest describes only real-time pet restricted-area warning analysis. This expands the data scope from single-run detection to retrieval of historical user-linked records, creating unnecessary privacy exposure and a risk of unauthorized access to prior analysis results if identity handling is weak.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code resolves an internal OpenID and uses `ConstantEnum.CURRENT__OPEN_ID` for listing analysis records despite the skill being presented as a pet-monitoring tool. Hidden identity binding increases the chance of collecting or using personal identifiers without clear user awareness, and it links operational video-analysis activity to a persistent user identity.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The implementation is a generic media-analysis/reporting client, not a narrowly scoped pet restricted-area warning skill as declared in the manifest. This scope mismatch is dangerous because it can cause users or orchestrators to send arbitrary local files or URLs to a broader backend analysis/export pipeline than expected, undermining trust boundaries and consent assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill exposes report enumeration and export-link generation capabilities unrelated to real-time pet warnings. If invoked in a shared environment, this can facilitate unintended access to historical analysis metadata or report URLs, expanding the data exposure surface beyond the stated use case.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file exposes broad generic CRUD and arbitrary HTTP wrapper methods that can interact with unspecified endpoints, which is not clearly tied to the stated pet-monitoring function. In a skill context, such reusable network primitives expand the attack surface and can enable hidden data exfiltration, unauthorized backend interaction, or future feature abuse even if the current file does not itself show the final call sites.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The get_user_by_username capability introduces user account lookup functionality that is unrelated to detecting pets in restricted areas. Unnecessary identity-related access increases privacy risk and may support account enumeration or collection of user data beyond the skill's declared purpose.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements generic user-account persistence, lookup, and mutation logic even though the declared skill purpose is pet restricted-area alerting. This creates unnecessary capability to store and manipulate identity records, increasing privacy and abuse risk if the skill or shared code path is invoked in contexts where user-account handling was not expected.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Automatic schema migration of a sys_user table is unrelated to pet-monitoring alert behavior and silently changes persistent storage on initialization. This broadens the skill's effective behavior and can normalize hidden account-database manipulation in a context where users would not expect it.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores token and open_token fields even though the skill is described as a home pet monitoring feature. Retaining authentication-like secrets without a clear need increases the risk of credential exposure, unauthorized account linkage, and privacy harm, especially in a local shared database used by multiple agents or skills.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The utility layer includes broad identity resolution, token handling, local user persistence, and remote login/registration flows that are not justified by a pet restricted-area alerting skill. In this context, the mismatch is dangerous because it silently expands the skill's capability to manage accounts, collect identifiers, and contact external services beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically calls a remote /sys/phoneLogin endpoint with register=1 and user identifiers, which can create or bind accounts without clear user action. For a pet-monitoring skill, silent identity creation and remote registration are especially concerning because they transmit personal/device-linked identifiers and establish external accounts unrelated to the advertised functionality.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code inspects environment variables, agent workspace structure, and filesystem layout to locate roots, skills, and data directories. While this may support framework behavior, in a narrowly scoped pet-alert skill it increases access to broader host context and enables the skill to discover and interact with files outside its immediate purpose.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow states that uploaded attachments or media files are automatically saved as local files, but does not clearly warn the user about retention, storage location, duration, or cleanup. For home monitoring footage, this creates privacy risk because sensitive indoor video may be persisted on disk unexpectedly and later exposed to other processes, users, or backups.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The documentation states API Key authentication and file upload support but provides no guidance on secure credential handling, upload restrictions, or privacy implications. While documentation alone is not an exploit, in a skill that may process home/pet media and reports, omission of these controls can lead to unsafe implementation, credential leakage, or inappropriate upload of sensitive content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` performs hidden identity resolution without any user-facing warning or transparent purpose. Secretly obtaining or normalizing identity in a monitoring skill is privacy-sensitive because it can enable backend tracking, cross-session correlation, or access to account-scoped data without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code uploads local file contents or forwards remote video URLs to an analysis service, but this file contains no user-facing notice, consent prompt, or data-handling disclosure. For a home pet-monitoring context, videos may contain private household scenes, making silent transmission a meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debugging are turned on globally, which can expose request URLs, headers, bodies, and responses in logs. Because this file handles tokens and identity data later, debug logging materially increases the chance of credential or personal-data leakage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code reads an API-key-related file from disk and uses it as an internal identity source without clear disclosure or validation. In this skill context, hidden credential/identity access is risky because users would not expect a pet-monitoring feature to inspect local secret material to establish external identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically injects app IDs, tokens, open tokens, tenant codes, skill metadata, and usernames into outbound HTTP requests. This creates undisclosed external transmission of identity and authentication data, which is particularly inappropriate for a skill whose stated purpose is local pet restricted-area monitoring.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 98% confidence
• Finding: This line performs an external POST request carrying openId/mobile/source to a remote login endpoint. The transmission is sensitive because it sends identity-related data off-host, and the danger is amplified by the skill's unrelated pet-monitoring description, which gives users little reason to expect account-linked network activity.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2