Back to skill

Security audit

Pet Separation Anxiety Relief (Owner Away) | 宠物分离焦虑舒缓(主人离家时)

Security checks across malware telemetry and agentic risk

Overview

The skill can analyze pet videos, but it also quietly creates or reuses an account, stores tokens locally, and sends home-camera media and identity data to cloud services with limited disclosure.

Install only if you are comfortable sending pet/home camera videos or URLs, report history queries, and internal identity values to the listed external services. Review the provider and retention expectations first, because this skill can silently create or reuse a local account identity and store authentication tokens in a workspace SQLite database.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
70% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises powerful capabilities such as shell, network, file read/write, and environment access through its documented workflow, but does not declare permissions or present clear guardrails. This creates a transparency and least-privilege failure: an agent may execute local scripts, access local files, and contact remote services without the user understanding the actual scope of access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest claims real-time pet monitoring and automatic comfort-action triggering, but the documented behavior includes backend identity creation, login/token handling, local SQLite persistence, and cloud history access that are not aligned with the stated purpose. That mismatch is dangerous because it can mislead users and downstream agents into granting trust, media, and execution privileges to a skill that performs materially different data handling and account-linked operations.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill markets itself as providing real-time monitoring and automatic intervention, while the implementation described here is limited to offline analysis and cloud history lookup. Security-wise, deceptive capability claims can cause overtrust and unsafe automation decisions, especially where users believe a system is continuously monitoring safety-relevant conditions.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The role instructions say the skill should trigger comfort actions based on anxiety level, but the documented outputs only provide recognition results and recommendations. While not an exploit by itself, this inconsistency encourages false assumptions about actuation capabilities and can lead users or orchestrators to rely on protections that do not exist.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script performs hidden internal identity resolution via OpenIdUtil.resolve_current_open_id even though the advertised function is only pet-anxiety video analysis. This creates an unnecessary identity-binding capability and enables listing analysis history tied to a user identifier, expanding the skill from local/media analysis into user tracking without clear user consent or documented need.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
This file exposes generic CRUD wrappers and arbitrary HTTP methods that accept caller-supplied URLs, which is broader than the declared pet separation-anxiety monitoring purpose. In a skill that may process camera events and pet/owner data, such unrestricted network primitives can be repurposed for unauthorized data exfiltration or interaction with unintended internal or external services if higher-level code passes untrusted input.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The http_post/http_put/http_get/http_delete methods provide direct caller-controlled network access with no visible restriction on destination, authentication scope, or protocol safety. In the context of a smart-home pet monitoring skill, this increases risk because camera-derived events, user identifiers, or device actions could be forwarded to arbitrary endpoints, and the primitive could also be abused for SSRF-style access to internal services depending on runtime deployment.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This file persists user/account records, including identity-like fields, which is not justified by the manifest's pet-anxiety monitoring purpose. That scope mismatch increases the risk of covert data collection, unnecessary retention, and privacy harm because sensitive user data is being stored outside the skill's stated function.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The DAO infrastructure creates and manages a broad persistent local database and generic CRUD layer, which materially exceeds the manifest's narrow real-time monitoring and comfort-action description. In this skill context, hidden persistence is more concerning because users would not reasonably expect general-purpose local data storage from a pet behavior automation feature.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The model stores token, open_token, email, and related identity/account data that are not justified by the stated pet-separation-anxiety use case. In this context that is especially suspicious because such fields enable credential or identity persistence unrelated to camera-based pet monitoring, raising privacy and account-compromise risk if the local SQLite DB is accessed.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility provisions and persists backend identities and tokens in a pet-anxiety skill, functionality that is unrelated to the declared camera monitoring and comfort-action purpose. It creates a hidden identity layer by reading workspace identity files, reusing local users, and generating default users, which can silently bind the skill to backend accounts and enable unauthorized or opaque data flows.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code automatically registers or logs in a user against external backend/health endpoints using synthesized identifiers and persists the returned tokens. In the context of a pet-care automation skill, this is unjustified and dangerous because it silently creates external accounts and establishes authenticated channels without a clear user action or need tied to pet monitoring.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default trigger is broad enough to activate on generic pet-video analysis requests, which increases the chance that unrelated user content will be routed into this skill and sent through its local-script/cloud-processing path. Overbroad invocation rules are risky because they can cause unintended data exposure and unexpected execution without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The keyword trigger list includes ambiguous everyday terms and contexts, making accidental activation more likely. In a skill that handles media files and cloud report lookups, ambiguous activation can expose private pet/home recordings or trigger backend operations the user did not clearly request.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill processes local media and network URLs and performs cloud-based history queries, yet it does not clearly warn users about privacy implications for home-camera footage, audio, report metadata, and possible account-linked backend processing. This is dangerous because users may unknowingly submit highly sensitive in-home recordings and associated identifiers to remote services.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code uploads either local video files or remote video URLs to an external analysis service without any user-facing disclosure, consent checkpoint, or clear indication that potentially sensitive home-camera footage is leaving the local environment. In the context of pet monitoring inside homes or boarding centers, those videos may capture people, interiors, schedules, and other sensitive data, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The code automatically initializes a local SQLite database on startup without any visible user-facing disclosure or consent path. In a consumer pet-monitoring skill, silent creation of persistent storage increases privacy risk because behavior-related and account-related data may be retained without the user's informed awareness.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
Automatic ALTER TABLE schema migration modifies an existing user database in place without notice, backup, or consent. That is risky because it silently changes retained data structures and can expand the categories of stored personal data beyond what the user originally expected.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads a workspace file named smyx-api-key.txt to derive an internal identity value without any disclosure, consent, or trust-boundary checks. Secret or identity files in shared workspaces may belong to another skill, user, or agent context, so silently consuming them can cause credential misuse, account confusion, or unintended cross-skill data linkage.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This request wrapper automatically injects user identity and authentication tokens into outbound HTTP requests and may send pnaUserName, X-Access-Token, X-Api-Key, and Authorization headers to external services. In a pet separation-anxiety skill, transmitting account identifiers and tokens without transparent disclosure or strict necessity creates a serious privacy and credential-exposure risk, especially if endpoints are misconfigured or broader than intended.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
91% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📁 格式支持 | 视频要求:支持 mp4/avi/mov 格式,最大 10MB;建议时长 ≥ 2 分钟 |
| 🔎 使用提醒 | **含音频的视频可提升检测准确率**(吠叫/嚎叫是核心焦虑指标),建议使用带麦克风的宠物摄像头 |
| 🔎 使用提醒 | 摄像头需固定,视角覆盖门口、客厅等宠物主要活动区域 |
| 🧑‍⚖️ 结果性质 | **监测结果仅供行为观察参考,不提供医疗诊断**;严重焦虑建议咨询兽医或专业行为师 |
| 🔎 使用提醒 | 部分宠物在门口等待属于正常行为,需与持续性焦虑行为区分(结合时长和频次综合判断) |
| 🔎 使用提醒 | 智能设备联动为推荐策略,实际执行需用户提前配置对应设备 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
Confidence
78% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-separation-anxiety-relief-analysis"
description: "AI-powered pet separation anxiety detection & relief when the owner leaves home. Real-time monitoring via smart camera detects typical anxiety signs—continuous vocalization, pacing, scratching doors/windows, destructive chewing. When anxiety reaches preset thresholds, the system auto-triggers comfort actions (play owner's pre-recorded voice, dispense treats via smart feeder, activate interactive toys) to reduce anxiety and destructive behavior, improving pet welfare. Scenarios: pet households (especially office workers / frequent travelers), pet boarding centers. | 通过智能家居摄像头(宠物摄像头)实时监测主人离家后宠物的行为,检测持续性发声(哀嚎、嚎叫)、来回踱步、抓挠门窗或破坏家具等分离焦虑典型表现。当焦虑行为达到预设阈值时,自动触发安抚动作,包括播放主人预录的安抚语音、联动智能零食机投掷零食、或启动互动玩具(如自动逗猫棒),减轻宠物独处时的焦虑,减少破坏行为,提升宠物福利。应用场景:宠物家庭(尤其上班族、经常出差的主人)、宠物寄养中心。"
version: "1.0.8"
license: "MIT-0"
---
Confidence
82% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2