Back to skill

Security audit

Pet Poop Auto-Clean Trigger (Robot Vacuum Integration) | 宠物排便自动清理触发(联动扫地机)

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a cloud video-analysis tool, but it silently creates or reuses persistent identities and stores account tokens, which needs user review before installation.

Review this carefully before installing. It sends provided videos or URLs to LifeEmergence cloud services, can query cloud report history, creates or reuses a persistent local identity, and may store account tokens/profile data in a workspace SQLite database. Install only if you accept that account linkage and cloud retention model, and avoid using sensitive home footage unless the publisher documents retention, deletion, and token protection clearly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
70% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
70% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The manifest exposes capabilities equivalent to environment access, filesystem read/write, network access, and shell execution without declaring permissions or clearly warning users. That mismatch weakens review and consent, and it increases the chance that the skill can access local data, persist uploads, or call remote services in ways users do not expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow video event detection, but the behavior includes creating local identities, storing them in SQLite, authenticating to remote account services, and listing historical reports. This is dangerous because it expands data collection and backend access beyond the stated purpose, making hidden account linkage and external data flows possible while users believe they are only submitting a pet video for analysis.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
Claiming the skill only outputs vision-based event detection while also performing cloud history retrieval and returning report links is a significant disclosure gap. Users and reviewers may underestimate external data sharing and metadata exposure, especially when report history can reveal timestamps, pet type, and usage patterns.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Automatic fallback to creating or reusing local user identities is unrelated to simple pet-waste video analysis and introduces persistent identity linkage. This can silently tie uploads and history to a local profile, creating privacy and data-retention risk without clear necessity or informed consent.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documented endpoints point to generic health-analysis and report-export APIs instead of a narrowly scoped pet-waste cleanup trigger interface. This mismatch can cause the skill to invoke or expose unrelated report functions, increasing the risk of unauthorized access to historical reports or data exports if integrated as documented.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The file claims to document an automated pet-cleanup trigger API, but the actual routes reference health analysis, paginated report history, and report export behavior. In a security review, this kind of cross-domain documentation inconsistency is dangerous because developers or agents may wire the skill to broader medical/reporting functionality than intended, potentially exposing sensitive data or enabling unintended actions.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill exposes functionality beyond its stated purpose by allowing hidden identity resolution and access to historical analysis results via `--list`/`show_analyze_list(open_id)` rather than limiting itself to current video-trigger analysis. This creates an unnecessary privacy boundary violation: a user invoking a pet-video analysis tool would not reasonably expect internal identity handling and history retrieval to occur, especially when `--open-id` and `--api-key` are suppressed from help output.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The code explicitly unwraps and returns generic "commonAiResponse" and especially "healthAiResponse" fields, which broadens the skill beyond the manifest's stated pet defecation-event detection purpose. This creates a scope-expansion and data-handling risk: users or upstream services may receive or process unrelated or potentially sensitive analysis content through a skill that appears narrowly scoped.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill outputs a generic report export link rather than a narrowly scoped cleanup trigger or event result, which is inconsistent with the manifest and may expose broader analysis artifacts than users expect. If the export endpoint serves full reports, this can leak unnecessary data and expands the effective capability of the skill beyond simple automation signaling.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The report-history listing function provides access to prior analysis records, a capability not described in the manifest for a trigger-oriented pet cleanup skill. Undocumented history access increases the risk of unintended data exposure, especially if past reports include URLs, images, or richer AI responses than the user expects this skill to retain or disclose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements a broad reusable API wrapper with generic paging, CRUD, and raw HTTP methods that materially exceed the manifest's narrowly described purpose of pet defecation video analysis and cleanup triggering. In a skill context, such unnecessary capability expands the attack surface and could be used by other parts of the skill to access or manipulate remote services unrelated to the declared function, undermining least privilege and making hidden data flows harder to audit.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The exposed http_post/http_put/http_get/http_delete methods provide arbitrary outbound network request capability, which is not justified by the stated pet-waste detection function. If any caller can influence the URL or request parameters, this becomes a powerful primitive for unauthorized data exfiltration, access to internal services, or use of the skill as a network proxy/SSRF component.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
User account lookup by username is unrelated to the declared vision-analysis behavior and introduces unnecessary access to identity data. Even if benignly intended as shared utility code, retaining this capability in a narrowly scoped pet-monitoring skill increases the chance of privacy leakage, user enumeration, or accidental misuse.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This skill is described as analyzing pet defecation-zone video and emitting a cleaning trigger, yet the DAO persists user-account records and supports lookup/update behavior unrelated to that function. Collecting and retaining identity and token-like data outside the declared purpose violates data minimization and expands the attack surface, especially because the module stores this data in a shared workspace database accessible across skills/agents.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores personal profile fields (real name, email, birthday, age) and authentication-like secrets (token, open_token) without any clear relation to a pet-waste video trigger skill. This creates unnecessary privacy and credential exposure risk if the local shared SQLite database is read by another component, mishandled, or copied from disk. The mismatch between declared functionality and stored data makes the collection especially suspicious and unjustified.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility implements remote account provisioning and authentication token acquisition/storage, which is far beyond the declared pet-waste video analysis purpose. Hidden identity creation and login flows increase the attack surface, can transmit user identifiers off-box, and may create or bind accounts without clear user knowledge or consent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code derives a persistent open-id from local files and a database, and generates one if absent, despite the skill being described as a vision event detector. This creates undisclosed identity persistence and tracking capability that is not justified by the stated function and could be abused for cross-session correlation or silent account linkage.

Vague Triggers

Medium
Confidence
83% confidence
Finding
An overly broad default trigger can cause the skill to activate on loosely related uploads or prompts, leading to unintended file handling, remote API calls, and identity association. In this skill, that matters more because invocation is tied to local saving and cloud-backed history/report behaviors, so accidental activation has privacy and operational consequences.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments are automatically saved locally but does not present this as a clear user warning. Silent persistence of user-supplied media can expose sensitive household footage to local compromise, retention issues, or unintended reuse beyond the immediate analysis task.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill mandates direct cloud API access for history queries without clearly warning that report metadata is fetched from external services. This can reveal behavioral metadata such as analysis times, pet types, report IDs, and links, which users may not expect when they believe the tool is only doing local vision-event detection.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
`OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` initializes internal user identity even though identity collection is not disclosed in the tool's primary interface or necessary for basic local/video URL analysis. Hidden identity access is dangerous because it can silently bind analysis activity to a user account and enable downstream data access or tracking without informed user awareness.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code reads the entire local file and uploads it for remote analysis without any visible user-facing disclosure, consent prompt, or data-minimization step in this file. For a home monitoring use case, uploaded videos may contain pets, people, interiors, and schedules, so silent transmission creates meaningful privacy risk even if the upload is functionally intended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
In debug mode, the HTTP wrapper logs request metadata and full response content, and earlier code enables verbose urllib3/http.client debugging. This can leak sensitive request/response data, operational details, and possibly tokens or user identifiers into logs without any user-facing warning.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2