Pet Water Fountain Intake Analysis | 宠物饮水机饮水量精准记录

• Outcome: Review
• Latest audit: Jul 27, 2026 · 7:35 AM UTC
• Version: 1.0.4

Overview

The skill performs the advertised cloud pet-video analysis, but it also silently creates or reuses an identity, logs in to a remote service, and persists auth tokens locally without enough user-facing control.

Review before installing. Expect uploaded videos or supplied video URLs to be sent to lifeemergence.com/open.lifeemergence.com services, and expect report history to be tied to an automatically managed identity. The main risk is not obvious malware; it is under-disclosed account creation/login behavior and local storage of service tokens in the workspace database. Install only if you accept that persistence and cloud processing model.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises substantial capabilities including local file handling, shell execution, environment access, and network communication, yet no permissions are declared to make those actions explicit to the host or user. This creates a transparency and governance gap: users may provide local files or URLs without realizing the skill can persist data locally, invoke commands, and transmit content to remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is pet video analysis, but the behavior described by analysis includes hidden identity persistence, local SQLite storage, and remote account/token acquisition unrelated to the user-visible function. This mismatch is dangerous because it conceals authentication, tracking, and data-retention behavior that can surprise users, expand the privacy/security boundary, and enable unintended account linkage or misuse of historical records.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script silently resolves and initializes an internal open_id even though its stated purpose is just video analysis. That creates hidden account-context access and can cause analysis or history retrieval to run under a user identity without clear disclosure or consent, which is a privacy and authorization concern in a health-monitoring context.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The function signature advertises api_url, api_key, and output_level as configurable inputs, but the implementation ignores them and always delegates to skill.get_output_analysis(input_path). This can mislead operators into believing they are controlling endpoint selection, credentials, or output behavior when in reality the script may use hidden defaults, undermining security expectations and auditability.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The CLI promises that --export-env-only will only output environment-variable export commands and not execute analysis, but the flag is never checked. Users may invoke it expecting a safe dry-run while the tool still performs networked or account-bound analysis, which can trigger unintended data processing or disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exposes a history-listing capability via `--list` that retrieves analysis records based on an `open_id`, even though the skill is described as a video-analysis tool. Because `--open-id` is a hidden/internal parameter and there is no visible authorization check in this file before calling `skill.get_output_analysis_list(open_id=open_id)`, this creates an access-control and privacy risk if an attacker can influence the resolved `open_id` or invoke the command in another user's context.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This file includes a generic user-account model and DAO with personal identity fields and account lookup/update behavior that are unrelated to the declared pet water intake video analysis purpose. Such hidden or unjustified identity-management capability expands the data-collection surface and can enable unexpected storage, correlation, or modification of user records beyond what users would reasonably expect from this skill.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The code initializes a writable local SQLite database, creates tables, and performs schema mutation, which exceeds the manifest's described role of analyzing pet fountain videos via server-side APIs. In a skill context, undeclared local persistence is dangerous because it allows retention of user-related data and state across runs without clear consent, visibility, or need tied to the advertised function.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The model stores token and open_token fields even though the skill is described as pet drinking-behavior analysis, not authentication or account brokering. Retaining authentication-like secrets in a local SQLite database creates a materially higher compromise impact, because anyone with file access or later code-path abuse could recover credentials or session artifacts unrelated to the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This utility code detects workspace paths, reads data from workspace files, creates a persistent default user identity, and stores cross-run state unrelated to the manifest's stated pet video analysis purpose. That hidden identity/state management expands the skill's access to local agent context and creates privacy and scope-creep risk, especially because users invoking a video-analysis skill would not reasonably expect local account state discovery and persistence.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code silently performs account registration/login via /sys/phoneLogin, derives an internal identity from local state, and persists returned tokens locally. That behavior is materially beyond 'analysis-only' video processing and can create or bind user accounts without clear consent, while leaving durable authentication artifacts on disk for later reuse or abuse.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The historical-report trigger phrases are broad enough that ordinary user language such as asking to 'view history' could automatically invoke cloud-side report retrieval. In a health-adjacent, identity-linked skill, unintended retrieval of historical reports can expose prior pet health data or surprise users by making remote API calls they did not clearly authorize.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill accepts local files and network URLs for server-side processing but does not clearly warn users that submitted media or referenced remote resources will be transmitted to backend APIs. This omission is risky because uploaded videos may contain sensitive household imagery, pets, bystanders, or metadata, and users may not understand the privacy implications of cloud processing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Hidden internal identity resolution introduces undisclosed user-context handling in a tool that appears to accept simple file/URL input. In a pet health-monitoring skill, that can expose account-linked history or cause actions to execute under a current user identity without transparent notice, increasing privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill reads the entire local file and sends it to a backend analysis service, but this file contains no user-facing consent, disclosure, or minimization step before transfer. In a health-monitoring context involving pet household videos, uploads can contain sensitive incidental data such as people, home interiors, or metadata, creating privacy risk if users are unaware their content is transmitted off-device.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code trusts OPENCLAW_WORKSPACE to determine the effective workspace root and then uses that location for subsequent reads/writes without user-facing disclosure. In an agent environment, this can expose or modify data in an unexpected workspace if the environment is manipulated or misconfigured, increasing privacy and boundary-isolation risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: HTTP requests automatically attach user identifiers and authentication tokens and also inject metadata such as tenantCode, skillHubName, skillPlatform, and pnaUserName into outbound requests. For a pet water-intake analysis skill, undisclosed transmission of identity and account linkage data broadens privacy exposure beyond what users would expect from submitting a video for analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 90% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供健康参考，不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 🧑‍⚖️ 结果性质 | 饮水量估算是基于饮水次数和时长推算，非直接测量，仅供参考 |

• Confidence: 78% confidence
• Finding: ‍

Hidden Instructions

High

• Category: Prompt Injection

Content

| 🧑‍⚖️ 结果性质 | 分析结果仅供健康参考，不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 🧑‍⚖️ 结果性质 | 饮水量估算是基于饮水次数和时长推算，非直接测量，仅供参考 |
| 🔎 使用提醒 | 多宠家庭需确保饮水机区域摄像头能区分不同个体，建议配合宠物个体识别技能使用 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |
| 📜 报告输出 | 表格输出示例 |

• Confidence: 78% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-pet-water-fountain-intake-analysis"
description: "Triggers when a user provides a pet water fountain area video URL or file for analysis; supports local video uploads or network URLs to call server-side APIs for water intake behavior recognition, tracking drinking frequency, single-session duration, and estimated daily intake per pet, comparing against historical baselines to detect sudden drops or spikes in water consumption, outputting early warning alerts for potential kidney disease or diabetes risk. Application scenarios: smart water fountains, multi-pet household health monitoring, pet chronic disease management. | 当用户提供饮水机区域视频URL或文件时，触发本技能进行饮水量行为分析；支持通过上传本地视频或网络视频URL，调用服务端API进行饮水行为识别，统计每只宠物的饮水次数、单次时长、日总饮水量，对比历史基线，对饮水骤降或骤升进行预警，辅助早期发现肾病或糖尿病风险。应用场景：智能饮水机、多宠家庭健康监测、宠物慢性病管理。"
version: "1.0.6"
license: "MIT-0"
---

• Confidence: 88% confidence
• Finding: description:; ‍; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2