Back to skill

Security audit

Pet Social Interaction Analysis | 宠物社交行为分析(与其他宠物互动)

Security checks across malware telemetry and agentic risk

Overview

The skill largely matches cloud pet-video analysis, but it silently creates or uses an identity, sends media or URLs to remote services, and persists account tokens locally without enough user control.

Review this skill before installing. It may upload pet videos or media URLs to a remote service, query cloud report history, create or reuse an internal user identity, and store service tokens in the workspace data directory. Use it only if that cloud processing and local token persistence are acceptable for the footage and environment involved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
69% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and operationalizes shell execution, file read/write, network access, and environment use via local scripts and cloud/API interactions, but declares no permissions or user-facing capability boundaries. This mismatch can cause the host agent to invoke sensitive capabilities without explicit review, increasing the risk of unintended data access, local persistence, or network exfiltration.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The document says the skill must not provide medical or training advice, but later includes intervention-oriented guidance such as isolation, adding resources, and consulting behavior professionals. This contradiction can lead the agent to provide quasi-behavioral recommendations beyond the declared safety boundary, creating user reliance on advice the skill claims it will not give.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script exposes a history-list capability via `show_analyze_list(open_id)` and `--list`, which goes beyond the advertised single-video pet interaction analysis. Because it is tied to a user identifier and there is no visible authorization or consent check in this file, it creates a privacy and scope-expansion risk where a caller may retrieve prior analysis records unrelated to the immediate task.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code resolves a hidden `open_id` and uses a current-user identifier flow even though the stated purpose is pet video analysis. Hidden identity linkage increases privacy risk and can enable unintended tracking or access to user-scoped data, especially because the parameter is suppressed from help and not justified to the user.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
This file implements a broad generic API wrapper with CRUD-style methods and arbitrary URL forwarding that is much wider than the declared pet social-interaction analysis purpose. In a skill expected to analyze pet behavior, exposing reusable network primitives increases the attack surface for unintended backend access, data exfiltration, and repurposing the skill to perform unrelated operations against internal or external services.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The get_user_by_username capability introduces user-account lookup functionality that is not justified by the stated pet-behavior analysis use case. If reachable by prompts, chained tools, or higher-level orchestration, it can enable user enumeration, privacy violations, or lateral access to account metadata unrelated to analyzing pet interactions.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file defines a generic sys_user account model and user DAO with identity fields and account lookup/update behavior that are unrelated to the manifest's pet social-interaction analysis purpose. Capability drift like this increases the attack surface, creates unnecessary personal-data handling, and suggests the skill may be performing undisclosed user management outside its stated scope.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The model stores token and open_token values for users, yet the skill description is limited to pet behavior analysis and gives no justification for handling authentication-like secrets. Persisting such tokens in a local SQLite database materially raises the risk of credential theft, account takeover, and misuse if the workspace or database file is accessed by another component or user.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code creates or recovers user identities, logs into a remote service, and persists tokens locally, which is unrelated to the declared pet social interaction analysis purpose. That hidden identity provisioning and remote account activity materially expands the skill's data-access and account surface, creating risk of unauthorized account creation, tracking, and token misuse without informed user consent.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code performs agent workspace discovery and creates/manages data and skills directories beyond the stated video-analysis function. In context, this grants filesystem awareness and installation-target control that could be abused to read from or write to broader agent workspaces, increasing the blast radius if the skill is compromised or misused.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The history-query trigger keywords are broad enough to overlap with normal conversational requests about reports or interactions, which may cause automatic cloud history retrieval when the user did not intend it. In a privacy-sensitive context involving uploaded media and behavior reports, unintended retrieval can expose prior report metadata or links.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill states that uploaded attachments and video/image files are automatically saved as local files, but this behavior is not surfaced as a clear privacy and data-handling warning to the user. Silent local persistence of potentially sensitive household camera footage increases privacy risk and may violate user expectations or retention requirements.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill sends network URLs to an API service for fetching and uses a cloud API for history retrieval without a prominent privacy warning. This can expose user-supplied media locations, report metadata, and associated identifiers to remote services without informed consent, especially sensitive for home surveillance footage.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id even though the identifier is hidden from normal help output and the comment explicitly says the user is not required to input it. This creates undisclosed identity binding and can cause analysis history or account-scoped data to be associated with, or retrieved for, a user without clear consent or transparency.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The skill reads arbitrary local video files into memory and transmits them to an external analysis service, yet this code shows no user-facing consent, privacy notice, path restriction, or minimization controls. In the context of pet-home surveillance footage, the uploaded content may contain sensitive household, location, and bystander information, so silent exfiltration to a remote service creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The tool sends the provided local path or remote URL to `skill.get_output_analysis(...)`, implying external service processing, but gives no user-facing warning that video content may be transmitted off-device. For a pet-monitoring skill, videos may contain homes, people, audio, routines, or location clues, so silent upload/processing creates meaningful privacy exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Enabling urllib3/http.client debug logging can expose request URLs, headers, bodies, and response content in logs. Since this same file handles tokens and user identifiers, debug mode can leak sensitive authentication or behavioral data to console output or collected logs without explicit user warning.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code automatically generates and persists a default open-id/user record when one is not supplied, without an obvious consent or disclosure step. Hidden identity creation can surprise users, create undeclared accounts, and establish durable tracking identifiers tied to future network activity.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request wrapper automatically attaches tokens, API keys, and username/open-id metadata to outbound requests and may include them in request data. For a skill advertised as pet interaction analysis, this undisclosed transmission of identifiers and credentials is privacy-invasive and increases exposure if endpoints, logs, or intermediaries are compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2