Pet Picky Eater Detection | 宠物选择性拒食识别

• Outcome: Review
• Latest audit: Oct 15, 2026 · 7:43 PM UTC
• Version: 1.0.11

Overview

The skill generally matches its pet-video analysis purpose, but it silently creates or reuses identity state, stores service tokens locally, and sends media and identity data to remote services with limited user-facing control.

Review before installing. Use only with media you are comfortable uploading to the provider, and avoid using it in shared workspaces unless you accept that it may create persistent local identity records and store service tokens. The publisher should add an explicit privacy notice, retention/deletion details, and a scoped authentication model before this is treated as low-risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported behavior includes API-key file handling, local workspace reads/writes, user record creation/update, and generic authenticated HTTP requests, none of which are transparently conveyed by the pet-analysis description. This materially increases risk because the skill can access secrets, persist identity data, and communicate with remote services under misleading cover, making the context more dangerous than a normal media-analysis tool.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit for metadata poisoning indicators in the manifest suggests suspicious or malformed metadata content, which can be used to confuse parsers, conceal instructions, or manipulate tool/skill interpretation. While the exact matched snippet is limited, this kind of manifest anomaly is more concerning in a skill that already shows major description-behavior mismatches and broad undeclared capabilities.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-picky-eater-detection-analysis"
description: "Triggers when a user provides a video of a pet feeding bowl area for analysis; supports local video uploads or network URLs to call server-side APIs for picky-eater behavior detection, identifying behaviors such as pushing kibble out of the bowl, picking only treats/freeze-dried bites, or sniffing then leaving without eating; records frequency and outputs feeding-adjustment suggestions to prevent malnutrition. Application scenarios: smart pet feeders, pet boarding centers, pet hospital inpatient wards. | 当用户提供宠物食盆区域视频时，触发本技能进行选择性�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file defines generic user-account persistence, including lookup and reuse of default users, which is materially outside the declared purpose of pet feeding-video analysis. In this context, unnecessary account handling increases attack surface and creates opportunities for identity mix-ups, overcollection, and unauthorized persistence unrelated to the user-visible skill behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores identity and authentication-adjacent data such as username, realname, email, token, and open_token, none of which is justified by a pet feeding behavior detection skill. Collecting and retaining these fields without clear need creates unnecessary exposure of sensitive data, and compromise of the local database would have impact far beyond the skill's advertised function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The HTTP helper automatically registers or logs in a user against external health-service endpoints and stores returned tokens before making requests. For a pet picky-eater video analysis skill, this is unjustified over-collection and external identity propagation; it expands the attack surface by sending user-linked identifiers to a third-party service and persisting auth material that could later be abused.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and instructs use of shell execution, file access, network access, and environment-dependent behavior, but does not declare an explicit tool scope or permissions boundary in the manifest. This increases the chance that the agent/runtime grants broader capabilities than users or reviewers expect, enabling unintended local file access, shell execution, or outbound network operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says it accepts local uploads and network URLs and calls server-side APIs, but it does not provide a clear user-facing warning that media, URLs, and derived report data are transmitted to cloud/server systems. Without explicit disclosure, users may unknowingly submit sensitive videos, internal URLs, or operational data to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow states that uploaded attachments or video/image files are automatically saved locally, but there is no clear user-visible warning about local persistence. Silent local storage increases the risk of unintended retention of potentially sensitive media and makes incident response, deletion, and privacy expectations harder to manage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code presents the command description, argument help text, and status/error messages only in Chinese, which forces a specific language on users without opt-in. Under the policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script exposes a hidden report-history feature via the undocumented/suppressed --open-id and --list flow, which goes beyond the stated purpose of analyzing a provided video. Because it retrieves prior analysis reports based on an internal identity value, it creates an unintended data-access surface that could expose user activity or sensitive pet-care records if invoked by an unauthorized caller.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code initializes and uses an internal open_id identity mechanism even though the advertised function is simple video behavior analysis. Hidden identity handling increases the risk of cross-user data access, especially since resolve_current_open_id and subsequent history retrieval occur without visible user consent or clear boundary checks in this file.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill reads arbitrary local file contents from a provided path and forwards the full video bytes to a server-side analysis API, but this code shows no user-consent, preview, or trust-boundary warning before exfiltration. In a skill handling local media, silent upload of local files can expose sensitive recordings or unrelated files if the path is user-controlled or mistaken.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code resolves and uses an internal open_id to access analysis history, introducing account-scoped data access that is not necessary for one-off video inference. Any hidden identity resolution tied to data retrieval expands the privacy and authorization attack surface and could enable cross-user history access if the identifier can be influenced or misbound.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script includes a history-listing mode that retrieves prior analyses for an account, which is broader than the declared purpose of analyzing a user-provided feeding-bowl video. Hidden or weakly documented access to account-scoped historical data increases the chance of unintended data exposure, especially if invocation context or authorization checks are weak elsewhere in the stack.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs outbound HTTP POST requests using caller-supplied parameters, which may transmit user or system data to external services. The file contains no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that network transmission occurs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file exposes broad generic request primitives and CRUD-style helpers (add/edit/delete/http_get/http_post/http_put/http_delete) that are not constrained to the stated pet video-analysis purpose. In an agent skill context, such wrappers can enable unintended outbound requests or reuse for unrelated data access/modification if higher-level code passes attacker-controlled URLs or parameters, expanding the skill’s capability surface beyond least privilege.

Content

No source excerpt is available for this finding.