Pet Scratch Post Frequency & Intensity Analysis | 宠物猫抓板使用频率与强度分析

• Outcome: Review
• Latest audit: Oct 27, 2026 · 11:59 AM UTC
• Version: 1.0.13

Overview

Review before installing: the “do not analyze” option can still submit video, and automatic sign-in can send credentials as account identity data.

Wait for fixes to the no-analysis option, credential handling and automatic HTTP debugging. Before use, confirm which account is reused and how cloud media and reports are retained or deleted. Submit only footage and URLs you intend to share with LifeEmergence.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The local-video and URL commands align with the declared purpose, while report-detail selection and saving results are supporting implementation details. However, the explicit --list command and associated history-report triggers introduce a separate retrieval capability not disclosed in the description. The module implementation is not supplied, so its underlying analysis, storage access, and server-side API behavior cannot be verified from this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk implements user-account persistence rather than video handling, scratch recognition, API submission, or observation reporting. A database layer could support the declared skill, but this code specifically manages personal account information and authentication tokens without any demonstrated connection to cat-scratching analysis. Those resources and capabilities are not represented in the description. The chunk does not itself show network transmission or token exfiltration; database operations occur when its classes and methods are invoked.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The main video-analysis path is consistent with the description, although the imported implementation is not supplied, so its API calls and analysis metrics cannot be verified. The additional --list path calls get_output_analysis_list(open_id=...) and exits without requiring video input. This is a distinct history-retrieval capability not disclosed in the declared purpose. Identity resolution and optional output-file writing are not independently treated as mismatches because they can support the described service workflow.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-pet-scratch-frequency-intensity-analysis"
description: "Triggers when a user provides a cat scratch post area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for scratch behavior recognition, analyzing scratch frequency, single-session duration, and intensity (estimated via vibration amplitude), outputting standardized observation data on stress level and claw health (without diagnosing diseases or prescribing behavior correction). Application scenarios: smart scratch post, multi-cat household stress management. Development reason: stress-induced abnormal scratch, early signs of be

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The analysis workflow lacks a privacy warning about sending user videos to a remote service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

Although the documentation mentions server-side APIs, the automatic workflow does not require a user-facing privacy notice before transmitting local media or submitting a media URL to the service. Indoor pet footage can expose people, conversations, and home details, while supplied URLs may contain access tokens; the recipient, retention policy, and cloud-history implications are not explained.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to analyze video, but does not prevent analysis.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The --export-env-only flag explicitly promises not to perform analysis, but args.export_env_only is never checked, so supplying it with --input or --url still invokes skill.get_output_analysis. In this server-side video-analysis context, that can cause unintended processing and potentially uploading private household footage despite the user's explicit no-analysis selection; the actual network behavior depends on the unprovided skill implementation.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are submitted to the analysis API without disclosure of the upload.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The code reads the entire local file, packages its contents as an upload, and passes it to the analysis API. No prompt, log, docstring, or comment in this workflow explains that the video is transmitted to a remote service; the comment only describes reading the file.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to perform analysis, but the code ignores it and proceeds with video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag explicitly promises not to execute analysis, but its value is never checked; when a video input is supplied, execution still reaches skill.get_output_analysis. Given the skill's stated server-side processing, this can cause unintended video submission or remote retrieval, although the downstream implementation is not shown. Household pet videos may expose private interiors or people, making violation of this no-analysis boundary privacy-sensitive.

Content

No source excerpt is available for this finding.

The skill includes persistent human-profile management unrelated to cat-scratch video analysis.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The User model supports storing human names, email addresses, birthdays, sex, and age alongside authentication tokens (L448–L465). This is implemented persistence capability, not merely an unused schema declaration: DAO initialization creates and migrates the user table (L180–L215), and UserDao exposes inherited CRUD operations (L470–L473). Although API authentication may justify token storage, persistent human demographic profiles are not justified by the manifest's video-analysis and pet-observation purpose.

Content

No source excerpt is available for this finding.

ai_chat documents an agent invocation but never invokes an agent or returns analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring states that ai_chat calls the openclaw agent through subprocess and returns an analysis result or session ID. However, the command and subprocess invocation are commented out; the code instead creates an empty dictionary and accesses result.stderr, raising an exception that is caught, so the method returns None without performing the documented analysis.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive write mode.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

At L101, opening a path with mode 'w' immediately erases any existing contents. The generically named open helper has no docstring, comment, confirmation, or user-facing message explaining this behavior; exception tracing does not disclose successful truncation.

Content

No source excerpt is available for this finding.

HTTP authentication silently submits user identity for remote login or registration without disclosure.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

An ordinary API request can automatically initiate remote login or registration with 'silent' and 'register' enabled, transmitting the selected identity as both 'openId' and 'mobile'. Server-side video analysis reasonably requires network access, but it does not by itself justify undisclosed account creation or transmitting an API secret as an identity, which is possible because API_SECRET_KEY takes precedence when selecting the username.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The external POST is not inherently suspicious because the skill explicitly relies on server-side APIs; however, its payload can contain API_SECRET_KEY copied into 'openId' and 'mobile'. Sending a credential as ordinary profile data creates unnecessary exposure to identity storage and request-body logging; this overlaps with the preceding authentication finding, and there is no evidence that the configured destination is attacker-controlled.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Loading configuration silently creates directories and a YAML file when the path is missing.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

YamlUtil.load performs filesystem writes despite appearing to be a read operation, without a warning, log, docstring, or explanatory comment. BaseEnum.init_subclass calls this loader during class definition (L053 and L058), so merely importing this module can create configuration files without disclosure.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default