Back to skill

Security audit

Pet Scratch Post Frequency & Intensity Analysis | 宠物猫抓板使用频率与强度分析

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised remote pet-video analysis, but it also silently manages cloud-linked identity and stores access tokens locally, so users should review it before installing.

Install only if you are comfortable sending pet-area videos or supplied video URLs to the lifeemergence.com service, linking reports to an automatically created or reused identity, and storing service tokens in a local workspace SQLite database. Avoid private household footage, intranet URLs, presigned links, or sensitive account identifiers unless that cloud workflow is intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (21)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises significant capabilities—shell execution, local file access, environment access, network access, and file writes—without declaring permissions or clearly surfacing them to users. This creates a transparency and governance gap: users and hosting platforms may invoke the skill without understanding that it can execute commands, read/write local data, and exfiltrate inputs to remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented behavior exceeds the declared purpose by automatically creating or reusing identities, performing remote login/account provisioning, storing auth tokens and user records locally, and retrieving historical cloud reports. That mismatch is dangerous because users may believe they are only submitting a video for analysis, while the skill is also handling identity, persistence, and account-linked cloud data flows that materially expand privacy and security risk.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The documented endpoints expose capabilities well beyond the declared scratch-behavior observation scope, including historical report listing, detailed report retrieval, and full report export. That scope mismatch is dangerous because it can enable an agent or integrator to access broader pet health data than users would reasonably expect, increasing the risk of unauthorized data access and function creep even if the manifest presents the skill as narrowly limited.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This service exposes generic create, update, delete, and arbitrary HTTP verb wrappers that are not constrained to the skill’s stated purpose of cat scratch-video analysis. In an agent skill context, such broad network capabilities can be repurposed to reach unintended internal or external endpoints, expand the skill’s effective permissions, and enable misuse beyond the declared function, especially if higher-level code passes user-influenced URLs or payloads.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This shared DAO provides broad CRUD access for sys_user records, including creation, modification, deletion, and username-based updates, which exceeds the stated cat scratch video analysis purpose. In an agent environment, overbroad data-handling capability increases the risk of unnecessary collection, cross-feature data coupling, and unauthorized mutation of local account data if this common module is reused by the skill.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The User model persists sensitive identity and credential-like fields such as username, realname, email, token, and open_token, and the DAO offers generic update paths for them without any visible access control, encryption, or purpose limitation. For a pet scratch analysis skill, retaining and mutating these fields is disproportionate to the stated function and raises privacy and account-compromise risk if the local database is exposed or misused.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The utility code implements identity resolution, default user creation, and account persistence that are unrelated to the declared pet scratch video analysis purpose. This expands the skill's authority and data handling surface, enabling silent user/account provisioning and reuse of local identities without clear user awareness or necessity for the advertised function.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The HTTP wrapper automatically performs phone-login style registration, token acquisition, token persistence, and payment/balance workflow handling for any request path. In a skill advertised as behavior analysis for cat scratch videos, this hidden account lifecycle behavior is scope-inappropriate and can cause undisclosed transmission of identity data to external services.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill reads workspace-local identity material from a file and creates or reuses local database user records even when the user only requested scratch analysis. This introduces undisclosed identity persistence and cross-session tracking that is not necessary for the narrow analytical purpose described.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The auto-trigger keywords for historical report queries are broad enough to activate cloud data retrieval based on common phrases such as viewing history or reports. In a skill that links results to internally managed identities and cloud records, overbroad triggering can cause unintended access to account-scoped data or unexpected network actions without clear user intent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill does not prominently warn users that supplied files or URLs are transmitted to server-side/cloud APIs for analysis and report retrieval. That omission is risky because videos may contain sensitive household imagery or metadata, and users may reasonably assume local-only processing from the high-level description.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documentation describes file upload and report export flows for pet health analysis without any warning about the sensitivity of uploaded videos and generated reports. In this context, videos from inside a home and exported health reports can contain sensitive behavioral and household information, so omission of privacy guidance increases the likelihood of mishandling, over-collection, or insecure sharing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code resolves internal user identity before validating inputs and does so through a hidden parameter suppressed from help output. In a pet-health/video-analysis context, this is more sensitive because it can silently bind analysis and history operations to an internal account context, enabling privacy issues, unexpected account linkage, or access to user-associated records without clear user awareness.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This code reads the entire local video file into memory and submits it to a server-side analysis API without any user-facing disclosure or explicit consent check in this file. Because pet-area videos may contain sensitive household imagery or metadata, users may unknowingly transmit private content off-device, creating a privacy and data-handling risk even if the transfer is functionally intended.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
When the input begins with http:// or https://, the skill forwards the URL to the backend as videoUrl without any user-facing disclosure in this code that external content will be fetched or processed by a remote service. This can surprise users and may expose private or internal URLs to the service, especially if users provide presigned, intranet, or otherwise sensitive links.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code reads an internal identity value from data/smyx-api-key.txt without any indication of user notice, consent, or provenance checks. Using workspace-local secrets or identifiers silently can lead to unauthorized account association and privacy issues, especially in multi-skill or shared-workspace environments.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The helper sends openId, mobile, and source fields to an external login/registration endpoint automatically. Because this occurs inside a general request wrapper rather than an explicit authentication flow, users may have no meaningful notice that identity data is being transmitted off-box.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供行为参考,不提供疾病诊断或行为矫正建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 🧑‍⚖️ 结果性质 | 力度估算基于摄像头观测的振动幅度,受拍摄角度、距离影响,仅作为相对参考 |
Confidence
88% confidence
Finding

Hidden Instructions

High
Category
Prompt Injection
Content
| 🧑‍⚖️ 结果性质 | 分析结果仅供行为参考,不提供疾病诊断或行为矫正建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 🧑‍⚖️ 结果性质 | 力度估算基于摄像头观测的振动幅度,受拍摄角度、距离影响,仅作为相对参考 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
| 📜 报告输出 | 表格输出示例 |
Confidence
88% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-pet-scratch-frequency-intensity-analysis"
description: "Triggers when a user provides a cat scratch post area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for scratch behavior recognition, analyzing scratch frequency, single-session duration, and intensity (estimated via vibration amplitude), outputting standardized observation data on stress level and claw health (without diagnosing diseases or prescribing behavior correction). Application scenarios: smart scratch post, multi-cat household stress management. Development reason: stress-induced abnormal scratch, early signs of behavioral issues. | 当用户提供猫抓板区域的视频URL或文件时,触发本技能进行抓挠行为分析;支持通过上传本地视频或网络视频URL,调用服务端API进行抓挠动作识别,分析抓挠频率、单次持续时间、力度(通过振动幅度估算),评估宠物压力水平和爪子健康状况,输出标准化观察结果(不诊断疾病、不提供行为矫正建议)。应用场景:智能猫抓板、宠物行为监测、多猫家庭压力管理。"
version: "1.0.7"
license: "MIT-0"
---
Confidence
91% confidence
Finding
description:; ‍; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2