Back to skill

Security audit

Pet Picky Eater Detection | 宠物选择性拒食识别

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches pet video analysis, but it automatically creates and reuses identities, logs into remote services, stores tokens locally, and retrieves cloud history with limited user control.

Review this skill before installing if you are uncomfortable with pet videos or report history being sent to remote services, automatic account/identity creation, or local storage of tokens in the workspace data directory. Use it only with media and account context you intend to associate with the remote service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use shell commands, read and write local files, access environment-backed identity handling, and make network requests, but it does not declare those capabilities or obtain explicit user-facing permission. This creates a trust and policy gap: users may trigger behavior that uploads videos to remote APIs or stores files locally without understanding the scope of access.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The script exposes a history-listing function via --list that retrieves prior analysis records for an OpenID, but this capability is not reflected in the stated skill purpose of analyzing a provided pet-feeding video. Undisclosed access to historical records broadens the data surface and can enable unauthorized enumeration or disclosure of prior user activity if access control is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The CLI resolves and uses an OpenID/account identifier even though the manifest describes only video analysis behavior. Introducing account-identity handling expands the skill from content processing into user-account context, increasing privacy and authorization risk if callers can influence which identity is resolved or if the identifier is reused across operations like history access.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This service exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the stated pet-feeding video analysis purpose. In a skill that should only process feeding-bowl videos, these reusable network primitives expand the attack surface and can enable unintended access to unrelated backend endpoints or data if other parts of the skill invoke them with user-influenced URLs or parameters.

Context-Inappropriate Capability

Low
Confidence
89% confidence
Finding
The get_user_by_username capability is unrelated to pet feeding video analysis and introduces unnecessary access to identity or account data. Even if not directly exploitable here, retaining unrelated user-lookup functionality violates least privilege and creates a path for privacy misuse or lateral feature abuse.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This code creates and persists default user identities unrelated to the stated pet video-analysis function, including generating usernames and writing them into local storage. That expands the skill's behavior into covert account/identity management, creating privacy, consent, and misuse risks if users did not explicitly authorize account creation.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The HTTP helper silently logs in or registers users against an external health-service endpoint using derived identifiers, then caches tokens for later use. For a pet picky-eater analysis skill, this is off-purpose and dangerous because it transmits identity data to external infrastructure and can create remote accounts without clear disclosure or user approval.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The utility reads a workspace file named like an API key file and reuses its contents as an internal identity source. This mixes credentials and identity material in a way users would not expect, and can cause unintended impersonation, credential repurposing, or leakage of sensitive workspace state into remote requests.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
This utility enumerates agent workspace structure and creates data/skills directories, enabling installation and environment management beyond the narrow video-analysis purpose. While not inherently exploit code, it broadens the skill's operational scope and can facilitate persistence, data placement, and cross-workspace effects if combined with other unsafe behaviors.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-report trigger keywords are broad enough to activate on generic requests such as 'history report' or 'show reports,' which could cause the skill to query and expose prior cloud-stored reports unintentionally. Because report retrieval is automatic and tied to an internal identity, accidental invocation can disclose sensitive historical data without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description says it supports local uploads and network URLs and calls server-side APIs, but it does not clearly warn users that their provided files or referenced content will be transmitted off-box for processing. That omission undermines informed consent and can lead to privacy or compliance issues, especially for uploaded media captured in homes, clinics, or boarding facilities.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The workflow states that uploaded attachments are automatically saved as local files, but it does not warn users about local storage, temporary retention, or cleanup. Silent local persistence increases the risk of unintended data exposure on the host, especially where media may contain household, facility, or operationally sensitive information.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) even though the parameter is hidden from normal help output and the code comment explicitly says the user is not required to provide it. That creates implicit identity access/association without clear user-facing disclosure or consent, which can lead to analysis history being tied to or retrieved for an internal identity unexpectedly.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill accepts either a local file path or a remote video URL and forwards that data to a server-side analysis API, but this code provides no user-facing disclosure, confirmation, or consent checkpoint before transmitting potentially sensitive pet videos. In contexts like homes, boarding centers, or hospitals, feeding-area video may contain incidental people, medical environments, or other private details, so silent upload/forwarding creates a real privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The hidden --api-key parameter accepts credential material while being suppressed from user-facing help, which reduces transparency and makes sensitive behavior harder to review or safely operate. Hidden credential inputs are risky because they can be abused by wrappers or integrations without clear disclosure, and they may encourage passing secrets on the command line where they can leak via process listings, logs, or shell history.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code performs network requests with credential-bearing headers such as X-Access-Token, X-Api-Key, and Authorization, without any visible user-facing disclosure in this file. In context, users expect pet video analysis, not silent remote identity/token exchange, so undisclosed transmission materially increases privacy and trust risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The utility silently reads an internal identity value from a workspace file with no warning, permission prompt, or indication that local agent state will be repurposed. This is risky because users and operators may not realize a local secret/config artifact is being used to identify them in later operations.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供喂养行为参考,不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
90% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-picky-eater-detection-analysis"
description: "Triggers when a user provides a video of a pet feeding bowl area for analysis; supports local video uploads or network URLs to call server-side APIs for picky-eater behavior detection, identifying behaviors such as pushing kibble out of the bowl, picking only treats/freeze-dried bites, or sniffing then leaving without eating; records frequency and outputs feeding-adjustment suggestions to prevent malnutrition. Application scenarios: smart pet feeders, pet boarding centers, pet hospital inpatient wards. | 当用户提供宠物食盆区域视频时,触发本技能进行选择性拒食行为识别;支持通过上传本地视频或网络视频URL,调用服务端API识别宠物把主粮拨出食盆、只挑拣零食/冻干、嗅闻后离开等挑食行为,记录发生频率,连续异常时输出喂养调整建议,预防营养不均衡(不诊断疾病)。应用场景:智能喂食器、宠物寄养中心、宠物医院住院部。"
version: "1.0.7"
license: "MIT-0"
---
Confidence
84% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2