Back to skill

Security audit

Pet Race Foul Detection (False Start / Lane Crossing) | 宠物赛跑/竞赛作弊识别(起跑/窜道)

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do the advertised video analysis, but it also silently creates or reuses an identity, stores tokens locally, and queries cloud report history.

Review before installing. Use this only if you are comfortable sending race videos or video URLs to the configured cloud service, allowing the skill to silently create or reuse an internal identity, storing service tokens in a local workspace database, and retrieving history reports tied to that identity. Prefer a dedicated workspace and avoid sensitive media unless the publisher explains retention, account scoping, and token storage controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documents capabilities to read/write local files, invoke shell commands, access environment-derived identity state, and make network/API calls, yet declares no corresponding permissions. This creates a misleading trust boundary: a reviewer or runtime policy engine may assume the skill is narrowly scoped to video analysis when it can also persist data and reach external services.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest promises only objective foul-judgment output, but the skill also advertises recommendations, report links, and history retrieval. This mismatch can conceal broader data handling and external interaction behavior from users and reviewers, undermining informed consent and safe policy decisions.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Automatic cloud retrieval of historical reports is outside the narrow stated purpose of analyzing a user-provided race video. Because broad phrases can trigger this behavior, the skill may access unrelated remote records without a clearly bounded user request, expanding data exposure beyond the current task.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill states that it will automatically reuse or create a local default user identity when none is supplied. Silent identity creation/persistence unrelated to video foul analysis can cause cross-session data linkage, accidental access to another user's historical reports, and opaque tracking without user awareness.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill is presented as a video foul-analysis tool, but it also exposes a hidden history-listing function tied to a user identity, which is outside the stated purpose and not clearly disclosed. Hidden secondary capabilities that access past reports can enable unauthorized data discovery or cross-user information exposure if identity resolution or authorization is weak.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code resolves an internal open_id and uses it for report access even though identity handling is not necessary for one-off video analysis described by the skill. Collecting or inferring identity without clear purpose increases privacy risk and may allow unintended account linkage or access to user-scoped data, especially when combined with hidden list functionality.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes a generic service layer with broad CRUD helpers and arbitrary HTTP verb wrappers that are not constrained to the skill’s stated purpose of objective race-video foul analysis. In a skill that should only analyze supplied video and return judgments, these primitives materially expand the capability surface and could be reused by other code paths to access or mutate unrelated remote resources.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The presence of add, edit, and delete methods means the code supports remote state-changing operations even though the manifest describes an analysis-only skill. That mismatch is risky because any path that reaches these helpers can perform unintended mutations on backend services, which is unnecessary for race foul detection and increases the chance of abuse or accidental damage.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements a generic persistent DAO and mutates local user-related data, which is not justified by the stated purpose of race-video foul detection. The mismatch increases risk because the skill gains durable storage and record-management capabilities that could retain unrelated personal data or be repurposed beyond objective video judgmenting.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The User model stores identity fields and especially token/open_token values, capabilities that are not needed for a pet race foul-detection skill. Unnecessary credential and identity storage expands the blast radius of compromise and creates privacy and secret-handling risk disproportionate to the skill's declared function.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility code automatically resolves identities, logs in or registers users, retrieves tokens, and persists them locally, which goes well beyond the skill's stated purpose of objective race-video foul analysis. This creates hidden account linkage and credential-handling behavior that users would not reasonably expect from a referee-assistance video skill, increasing privacy and unauthorized-account-use risk.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code performs agent workspace discovery, identifies whether it is running in a main or sub-agent context, and creates data/skills directories. While not directly malicious, this broadens the skill's filesystem awareness and operational scope beyond race foul detection, which increases the blast radius if combined with other components or future misuse.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code reads local workspace files and database state to derive or create internal identities, including fallback generation of persistent user IDs. For a skill advertised as objective foul detection, this is unrelated sensitive identity handling and can silently bind a user/session to locally stored credentials or identifiers.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger activates whenever a user provides a relevant race video, even if the user's intent is something else such as summarization, archiving, or unrelated discussion. Overbroad auto-invocation can cause unintended processing of sensitive media and unnecessary external API use.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The history-query trigger uses broad natural-language phrases that could overlap with ordinary conversational requests, causing unexpected cloud retrieval of historical reports. This increases the chance of accidental data disclosure or unnecessary remote access without explicit informed user intent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The hidden initialization of current user identity is not user-facing and creates a transparency and privacy problem. Undisclosed identity access is dangerous because users may believe the tool only analyzes a provided video, while it may also bind actions to internal identities and unlock access to historical data or other account-scoped behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The helper posts identity-related fields such as openId and mobile to an external service, and the code provides no user-facing notice or consent flow in this file. Even if sent over HTTPS in some deployments, the hidden transmission of personal/account identifiers from an unrelated video-analysis skill is a meaningful privacy and trust issue.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The generic request wrapper attaches application IDs, user identifiers, and authentication tokens to outbound requests while silently augmenting request bodies with tenant, hub, platform, and username metadata. In the context of a race foul detection skill, this hidden data transmission is over-scoped and can leak account/session context without clear user awareness.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB;建议帧率 ≥ 60fps 以保证起跑时序精度 |
| 🔎 使用提醒 | 起跑判定阈值(反应时下限)和窜道判定容差由 API 端按赛事规则自定义 |
| 🧑‍⚖️ 结果性质 | 分析结果仅作为裁判辅助参考,最终判罚以现场主裁判决为准 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,API 服务会自动下载 |
| 📁 格式支持 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown 表格格式输出,包含"报告名称"、"宠物类型"、"分析时间"、"点击查看"四列,其中"报告名称"列使用`宠物竞赛犯规检测报告-{记录id}`形式拼接, "点击查看"列使用 `[🔗 查看报告]()` 格式的超链接,用户点击即可直接跳转到对应的完整报告页面 |
Confidence
83% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-race-foul-detection-analysis"
description: "Triggers when a user provides a pet racing track start/finish video URL or file for analysis; uses HD cameras at the starting line and finish line to analyze race video in real time, detecting each pet's (greyhounds, racehorses, etc.) start time, finish order, and lane assignment, automatically determining false starts (start before the signal) or lane crossing (deviating from own lane into an adjacent lane) fouls and outputting judgment results. Assists referee decisions and improves race fairness. Application: pet racing (greyhound, horse, obstacle course), pet sports events, professional track training. Does NOT provide race advice — only returns objective video-based judgment results. | 当用户提供宠物赛道起点/终点视频URL或文件时,触发本技能进行竞赛犯规检测分析;通过架设在赛道起点和终点线的高清摄像头,实时分析比赛视频,检测每只宠物(赛犬、赛马等)的起跑时间、通过终点线的顺序以及所在道次,自动判定是否存在抢跑(起跑时间早于发令信号)或窜道(偏离自身赛道进入邻道)等犯规行为,并输出判定结果。辅助裁判决策,提高赛事公平性。应用场景:宠物竞速比赛(灵缇赛跑、赛马、宠物障碍赛)、宠物运动会、专业赛道训练。仅输出基于视频的客观判定结果,不提供赛事建议。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
79% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2