Pet Treadmill Intensity & Heart Rate Analysis | 宠物跑步机运动强度与心率关联

• Outcome: Review
• Latest audit: Jun 28, 2026 · 11:50 AM UTC
• Version: 1.0.0

Overview

The skill can perform the advertised pet video analysis, but it also automatically links uploads and report history to a persistent cloud identity and stores tokens locally.

Review before installing. Use this only if you are comfortable sending pet treadmill videos or video URLs to the provider's cloud service and having results tied to an automatically managed local/cloud identity. Avoid sensitive household footage, and expect local token/user state to persist under the workspace data directory. VirusTotal was clean; the Review verdict is based on the artifact-backed identity, persistence, and cloud-history behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 79% confidence
• Finding: This getattr(self.__model__, key) uses keys from the caller-supplied filters dict, so an untrusted caller can select arbitrary model attributes for query construction. While SQLAlchemy prevents classic SQL injection here, this still enables unintended access patterns, crashes via invalid attribute names, and querying on sensitive/internal columns that the API may not intend to expose.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 78% confidence
• Finding: As in list(), the count() method accepts arbitrary filter keys and resolves them dynamically against the model. This can let untrusted callers probe internal schema details, count records by sensitive fields, or trigger errors/denial of service by supplying invalid or unexpected attributes.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no explicit permissions, yet the documentation clearly instructs use of shell execution, local file handling, network access, and implicit environment/identity use. This permission gap is dangerous because it prevents accurate user or platform review of what the skill can actually do, especially when it also handles uploaded media and backend queries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is pet exercise analysis, but the skill also describes account provisioning, persistent local identity reuse/creation, token storage, historical report enumeration, and remote backend login flows. This is a significant behavior mismatch because users invoking a video-analysis skill would not reasonably expect identity management and persistent account linkage, creating privacy and trust risks.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Automatic cloud history-report querying is introduced as a built-in behavior even though the core task is current treadmill-intensity analysis. That broadens data access beyond the immediate user request and can expose prior records or cause backend access without clear, informed consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation specifies silent internal identity handling, fallback to a local default user, and automatic account creation/reuse. This is especially dangerous because it enables persistent identity linkage and report access without transparent user awareness, increasing the risk of cross-session data exposure or access under the wrong account.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script exposes hidden identity handling via --open-id and a history-listing mode through skill.get_output_analysis_list(), which is outside the stated purpose of real-time treadmill intensity analysis. If OpenIdUtil.resolve_current_open_id or the history API accepts attacker-controlled identifiers without strict authorization checks, a user could enumerate or access another user's prior analysis records, creating an IDOR-style privacy issue.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill accepts arbitrary http/https URLs and forwards them to the backend for analysis without restricting origin, scheme beyond basic prefix checks, or tying the source to the described treadmill/local-camera workflow. This expands the trust boundary and can enable backend-side fetching of attacker-controlled URLs, creating SSRF-like exposure, unexpected data ingestion, or analysis of untrusted remote content.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script exposes a history-listing feature via `--list` and `show_analyze_list(open_id)` that is not aligned with the stated real-time pet treadmill intensity analysis purpose. Extra data-access functionality increases attack surface and may allow enumeration or retrieval of prior analysis records tied to a user identity, creating privacy and unauthorized access risk if upstream authorization is weak.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The skill imports and uses OpenID-based identity context even though the declared function is exercise-intensity analysis from video and optional heart-rate data. Introducing identity linkage where it is not clearly necessary raises privacy concerns, enables cross-session tracking, and can connect sensitive animal/owner activity data to a persistent identifier.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This class exposes generic outbound HTTP helpers (`http_post`, `http_put`, `http_get`, `http_delete`) that can send requests to arbitrary caller-supplied URLs, which is far broader than a pet treadmill intensity-analysis skill needs. In an agent/plugin setting, this creates a reusable network primitive that can be abused for data exfiltration, SSRF-style access to internal services, or invoking unintended third-party endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The generic `add`, `edit`, and `delete` helpers allow remote state-changing operations without any evident business-specific restrictions. For a skill whose stated purpose is exercise analysis, such broad mutation capability is unjustified and increases the attack surface for unauthorized changes or abuse of connected backend services.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill is described as pet treadmill intensity analysis, but this module persists and mutates user-account data including username, realname, email, birthday, token, and open_token. That broader identity storage materially expands the privacy and attack surface beyond the stated purpose, creating risk of unnecessary collection and local retention of sensitive user data.

Description-Behavior Mismatch

Medium

• Confidence: 72% confidence
• Finding: This code initializes a general-purpose local SQLite database, creates tables, and performs schema migration in a skill whose manifest describes video-based exercise-intensity analysis. Even if not overtly malicious, this mismatch increases suspicion because it enables persistent state and broader data storage capabilities unrelated to the core function, which can be abused for hidden collection or retention.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The utility provisions and persists user identities outside the stated purpose of pet treadmill intensity analysis. It reads workspace identity sources, creates default identities, and stores them for reuse, which introduces hidden account binding and identity persistence that users would not reasonably expect from a video-analysis skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The HTTP helper automatically logs in or registers users with external services and injects tokens into outbound requests, which is materially broader than the manifest's declared function. This creates undisclosed external account activity and network transmission of identity and authentication data, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads a workspace file and local database to derive an internal `open-id`, then falls back to generating and persisting one. For a pet exercise analysis skill, this hidden identity discovery and reuse is unnecessary and can cause unintended correlation of user activity across runs or services.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger fires whenever a user provides treadmill exercise video for analysis, with little additional constraint. Overly broad triggers are risky because they can invoke networked and stateful behaviors unexpectedly, especially in a skill that also performs cloud queries and identity reuse.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The keyword-based trigger list includes broad terms like treadmill, heart-rate monitoring, and exercise intensity, which may match ordinary discussion rather than a deliberate request to execute the skill. Ambiguous auto-invocation becomes more dangerous because this skill also saves files and contacts remote services.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The history-report query trigger relies on natural-language phrases such as viewing report lists, which can overlap with casual requests. In a skill with cloud lookups and internal identity association, accidental triggering could expose prior report metadata or cause unauthorized backend retrieval.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill does not clearly warn users that uploaded videos, URLs, and history queries may be sent to cloud APIs and associated with internal identities. Missing privacy disclosure is dangerous here because the data involves media, potentially sensitive behavioral information, and persistent report/account linkage.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code transmits local video content or a remote video URL to an external analysis service with no visible consent, warning, or data-handling disclosure in this file. For a pet treadmill skill, uploaded videos may still contain household interiors, people, location cues, or optional health-related telemetry, so silent transfer creates privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The hidden `--api-key` argument allows credential input while suppressing it from help output, reducing transparency around secret handling. Hidden credential pathways are risky because users may unknowingly expose secrets through shell history, wrappers, or logs, and reviewers may miss that the skill accepts authentication material.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The analysis path forwards a local file path or remote URL into backend processing without clear disclosure that data may be transmitted off-device. In this skill context, treadmill video and optional biometrics can reveal sensitive information about owner routines, location context, and health-related animal data, so undisclosed network transfer is a meaningful privacy and trust issue.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The `delete` method issues a remote POST for a destructive operation with no visible warning, confirmation, or safety control in this abstraction. In an agent-integrated skill, this can enable silent remote deletion or other destructive backend actions if higher layers call it with attacker-influenced parameters.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2