Pet Restricted Area Alert Skill | 宠物禁区预警技能

• Outcome: Review
• Latest audit: Oct 11, 2026 · 6:06 PM UTC
• Version: 1.0.17

Overview

The skill broadly matches pet video analysis, but it silently creates or reuses a cloud identity, stores session tokens locally, and uploads sensitive home-monitoring media without enough user-facing privacy detail.

Install only if you are comfortable sending pet/home monitoring videos or URLs to the configured lifeemergence cloud service and having report history associated with a silently managed identity. Before using it on sensitive indoor footage, confirm retention, deletion, account binding, and who can access generated reports or stored tokens.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The apparent implementation performs external API communication, authentication handling, user lookup/creation, local file access, and reading API/open-id values from local files, none of which are clearly conveyed by the benign pet-monitoring description. In the context of home surveillance, undisclosed identity handling and remote transfer materially increase privacy risk and can lead to unauthorized access to user-associated reports.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implementation is a generic file/URL submission and report-listing client, not a narrowly scoped pet restricted-area warning skill as described in the metadata. This capability mismatch is dangerous because it broadens the skill into a general content exfiltration and remote-analysis tool, increasing the chance that users or downstream agents send arbitrary local files or external URLs to a backend service under a misleading safety context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file exposes a broad, generic API wrapper with add/edit/delete and arbitrary GET/POST/PUT/DELETE methods that are not constrained to the pet-monitoring functionality described in the skill manifest. In an agent-skill context, this creates excess capability: other parts of the skill can use this service to send or modify data to arbitrary endpoints, increasing the risk of unauthorized exfiltration, command-and-control style communication, or unintended remote side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The http_post/http_put/http_get/http_delete methods accept a caller-supplied URL and forward requests directly, enabling arbitrary outbound network access. For a pet restricted-area warning skill, this is unjustified and dangerous because it can be repurposed to contact attacker-controlled infrastructure, exfiltrate observations or credentials, or interact with internal services if the runtime has network reachability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility module contains broad identity resolution, token handling, database-backed user persistence, and remote login/registration flows that are unrelated to a pet restricted-area alerting skill. In skill context, that mismatch is highly suspicious because it enables external account operations and outbound authenticated API activity well beyond the stated purpose, increasing the blast radius for data misuse, hidden telemetry, or unauthorized service interaction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code automatically resolves or creates an open-id, reads fallback identifiers from local workspace files and databases, and can silently register/login users remotely via downstream logic. For a home pet monitoring skill, silent identity creation and persistence is unjustified and dangerous because it can create external accounts or link local identities without informed user approval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and instructs use of shell execution, filesystem access, network access, environment/config usage, and local persistence behavior, but does not declare any explicit tool scope or permissions boundary. This creates an authorization gap where a reviewer or runtime may underestimate the skill's actual capabilities, increasing the chance of over-privileged execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill discusses pushing snapshots, cloud history queries, URL-based media submission, and API-driven analysis, but it does not provide a clear privacy warning that user media and derived images may be transmitted to and stored by remote services. For indoor pet/home monitoring, this omission is significant because the media can reveal private living spaces, routines, and occupants.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documents pet health analysis APIs even though the skill is described as a restricted-area warning/behavior monitoring skill. This mismatch can cause the agent or integrators to call unrelated endpoints, expose health-report functionality unintentionally, or process data outside the intended scope of the skill. The context makes this more suspicious because it indicates possible skill repurposing or accidental cross-domain coupling rather than a harmless wording issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code presents validation errors, status messages, reports, and CLI descriptions exclusively in Chinese, which imposes a specific language on users without opt-in or documented locale scope. That matches a natural-language policy violation for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes a history-listing function that retrieves prior analysis results, which goes beyond the stated real-time pet restricted-area warning purpose. Expanding from single-run analysis to account history access increases exposure of potentially sensitive monitoring data and can enable unauthorized enumeration of prior surveillance records if access controls are weak or identity handling is implicit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs hidden internal-identity resolution via OpenIdUtil.resolve_current_open_id even though pet video analysis should not require undisclosed identity binding. This creates unnecessary coupling to an internal user context and can cause requests or history access to run under a resolved identity without explicit user awareness, increasing the risk of privacy leakage or unauthorized data access.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2