Pet Respiratory Rate Abnormal Detection (Resting) | 宠物呼吸频率异常监测（静息）

• Outcome: Review
• Latest audit: Oct 15, 2026 · 3:57 AM UTC
• Version: 1.0.7

Overview

The skill is a cloud-backed pet video analysis tool, but it silently creates or reuses an identity and stores authentication tokens while sending media and report queries to a remote service.

Install only if you are comfortable sending pet videos or provided video URLs to the configured cloud service and allowing the skill to maintain a local identity database with reusable tokens. Review the publisher and service privacy terms, and avoid using private/internal URLs or sensitive household footage unless you intend cloud processing and report retention.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrowly scoped pet respiratory-monitoring tool, but the detected behavior indicates broader remote API invocation, report retrieval, identity handling, and generic analysis functionality not disclosed in the core description. This mismatch is dangerous because users and orchestrators may grant trust, data, or permissions under false assumptions, enabling covert collection, storage, or processing of sensitive video and account-linked information.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-respiratory-rate-abnormal-detect-analysis"
description: "AI-powered non-contact pet respiratory rate monitoring at rest. Detects thoracic-abdominal motion via a fixed camera, calculates breaths-per-minute, and compares against species/body-size resting norms; triggers early-warning when abnormal (e.g. dog >30 bpm, cat >40 bpm, or <8 bpm). Helps detect cardiopulmonary, respiratory or heat-stress risks early. Scenarios: home night monitoring, animal hospital wards, pet boarding centers. | 通过宠物窝或休息区固定摄像头，在宠物静息状态下分析其胸腹部起伏运动，自动计算呼吸频率（次/分钟），并与

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The User model stores token and open_token values even though the stated skill purpose is respiratory monitoring. Storing authentication-like secrets without clear need or dedicated protections increases the risk of credential leakage, lateral access, and misuse, especially since this DAO writes to a shared workspace database reused across agents/skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code silently resolves an open ID by reusing global state, reading a local file, querying a local database, or generating and persisting a new default identity. That behavior is unrelated to respiratory monitoring and creates a covert identity bootstrap mechanism that can impersonate or track users without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This utility file performs authenticated backend operations, token handling, user lookup, silent account creation, and API request interception that are unrelated to pet respiratory-rate analysis. In a skill whose declared function is passive health monitoring, bundling hidden identity/account lifecycle logic greatly expands the attack surface and can cause undisclosed access to external services under local or inferred identities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool scope or permissions even though the manifest and workflow indicate use of shell execution, network access, local file handling, and likely environment-dependent behavior. This weakens least-privilege controls and makes it harder for a platform or reviewer to constrain what the skill is allowed to do, increasing the risk of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill accepts local files and URLs and describes cloud-backed reporting, yet it does not prominently warn users that pet videos and associated reports may be transmitted to and stored by remote services. This is a privacy and consent issue because users may unknowingly submit household imagery and account-linked health-monitoring data to external infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default trigger condition is broad enough that ordinary video-analysis requests mentioning breathing-related terms could automatically invoke this skill without strong confirmation that the user intended cloud analysis or report access. Over-broad auto-triggering increases accidental processing of sensitive media and can cause unintended execution paths with networked data transfer.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation expands from one-time respiratory analysis into cloud-backed historical report retrieval and report-link exposure, but this secondary data-access behavior is not clearly represented in the primary capability declaration. Hidden or under-declared data retrieval increases the chance of unauthorized access to prior reports or leakage of report URLs tied to a user identity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script exposes a history-listing function via --list that is not part of the stated respiratory-rate analysis purpose. Combined with the implicit use of ConstantEnum.CURRENT__OPEN_ID, this expands the skill from single-purpose analysis into access to prior reports, increasing privacy and data-exposure risk if invoked by unintended users or contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The call to resolve internal user identity is not necessary for basic respiratory-rate detection and is hidden from normal user-facing help. Undocumented identity binding creates a privacy risk and can enable data association, report access, or tracking beyond what users would reasonably expect from a media-analysis tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script resolves a current internal open_id while suppressing the relevant argument from help output, which hides identity-related behavior from users. Hidden collection or inference of user identity is dangerous because it undermines transparency and can facilitate silent correlation of analyses and history to a person or account.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill accepts arbitrary http/https video URLs and forwards them for backend analysis, which expands its capability beyond the stated fixed-camera local monitoring use case. This can enable unintended remote resource fetching, privacy issues, and possible SSRF-like abuse against the downstream analysis service if internal or sensitive URLs are accepted there.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2