Security audit
Security checks for vulnerabilities and agentic risk
This skill performs the advertised pet video analysis, but it also silently creates or reuses a cloud-linked identity, uploads local media to remote services, queries cloud history automatically, and stores account tokens locally.
Review this skill before installing. Use it only if you are comfortable sending pet fountain area videos or URLs to the listed cloud services, having reports linked to an automatically managed internal identity, and allowing local storage of service tokens in the workspace data directory. Avoid using sensitive household footage unless the provider's retention and deletion practices are acceptable to you.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
This mismatch includes automatic user registration/login, token management, identity resolution, and filesystem manipulation that are not central to the stated pet-video analysis purpose. Hidden account linkage and authenticated API access can expose users to privacy harm, unexpected cross-session tracking, and misuse of backend authority if users are not clearly informed.
Metadata poisoning indicators in the manifest suggest the description field may contain obfuscation or crafted content intended to confuse tooling, policy evaluation, or downstream parsers. In a skill manifest, such tampering is especially risky because metadata often drives trust, routing, and capability decisions before deeper inspection occurs.
---
name: "smyx-pet-water-fountain-intake-analysis"
description: "Triggers when a user provides a pet water fountain area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for water intake behavior recognition, tracking drinking frequency, single-session duration, and estimated daily intake per pet, comparing against historical baselines to detect sudden drops or spikes in water consumption, outputting early warning alerts for potential kidney disease or diabetes risk. Application scenarios: smart water fountains, multi-pet household health monitoring, pet chronic disease management. | 当用�
The skill accepts local files and network URLs and states that server-side APIs process them, but it does not clearly warn users that their uploaded media or referenced URLs are sent to remote/cloud services. For video of a home pet fountain area, this can expose sensitive household imagery and metadata without informed consent.
The request wrapper can silently auto-register or log in a user against a health backend using a derived username/openId, then cache tokens for future calls. In the context of a pet fountain analysis skill, silently enrolling users in an unrelated health service is a serious overreach that can leak identifiers, create shadow accounts, and transmit data to an unexpected third party.
The skill declares powerful capabilities in practice—shell execution, file read/write, network access, and environment access—but does not constrain them with an explicit permission or allowed-tools policy. That creates an unnecessary trust gap: a consumer cannot tell what the skill is permitted to do, while the workflow clearly instructs execution of local scripts and cloud interactions.
The trigger phrases for history-report queries are broad enough that ordinary conversation could unintentionally invoke cloud history retrieval. In this skill, accidental activation is more dangerous because it may access prior health-adjacent reports tied to an automatically associated internal identity.
The documentation instructs the system to silently receive, reuse, or auto-create internal user identities and associate them with historical reports. For a skill framed as simple video analysis, this is unnecessary identity coupling that enables undisclosed user tracking and persistence across sessions.
The skill does not clearly warn that history queries are performed against cloud services using an automatically associated internal identity. This creates a hidden identity-to-report linkage and can surprise users who believe they are only requesting local or session-scoped analysis results.
The user-facing string on L17 is hard-coded in Chinese, which indicates a fixed language choice in the skill's output. The file does not show any opt-in, locale negotiation, or documentation justifying a Chinese-only experience, so this may violate language/locale policy requirements.
This Python file contains multiple natural-language strings in Chinese for the command description, argument help, and status/error messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Several user-visible strings are fixed in Chinese, including report headers, warnings, and error messages. This imposes a specific locale without offering opt-in, fallback, or configuration, which matches the language-policy violation criteria.
For local inputs, the code reads the entire file and uploads it to the analysis service without any user-facing confirmation or explicit notice at this layer. In an agent setting, this can cause unintended exfiltration of local files if a user or upstream component supplies a sensitive path instead of the intended video, especially since the code accepts any readable file with an allowed extension.
Detected: suspicious.install_untrusted_source