Back to skill

Security audit

Pet UV Safety Monitor Analysis | 宠物紫外线消毒安全监测

Security checks across malware telemetry and agentic risk

Overview

The skill is a UV pet-safety analysis wrapper, but it uses remote analysis, automatic identity creation, local token/user persistence, and cloud history access in ways that need careful review before installation.

Install only if you are comfortable sending pet/home camera videos or URLs to the publisher's remote service and having the skill create or reuse a local/cloud-linked identity with locally stored tokens. Do not rely on it as an actual real-time UV safety shutoff system unless the missing live monitoring and device-control pieces are separately verified.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The manifest presents a safety-monitoring skill but declares no permissions while instructing use of shell execution, network access, local file handling, and likely environment/config usage. This under-declaration prevents meaningful user or platform review and can hide materially risky capabilities behind an innocuous description.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The described purpose is real-time pet UV safety monitoring, but the analyzed behavior includes hidden identity creation/reuse, token/account management via a remote login API, and historical report retrieval with exposed links, while lacking the claimed local monitoring logic. This is a classic description-behavior mismatch that can mislead users into authorizing data collection and remote account actions unrelated to the advertised function.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
Automatic cloud querying of historical reports and retrieval of report links expands the skill's data-access scope beyond the core task of analyzing current UV safety conditions. This creates unnecessary exposure of prior records and increases privacy risk, especially when triggered automatically from broad keywords.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill instructs implicit identity handling, including silent reuse or auto-creation of a local default user, without tying that behavior to the stated UV safety purpose. Hidden identity lifecycle management can enable persistent tracking, account confusion, or unauthorized access to another user's cloud-linked reports and tokens.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The script performs hidden internal identity resolution and exposes a history-listing mode unrelated to the stated single-run UV pet safety analysis purpose. Because `--open-id` and `--api-key` are suppressed from help while `OpenIdUtil.resolve_current_open_id(...)` and `show_analyze_list(...)` are still reachable, the tool may enable undisclosed user-context resolution and access to prior reports, creating privacy and authorization risks if history can be retrieved for the wrong identity.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation materially diverges from the declared UV pet-safety purpose and instead provides a generic file/URL submission and report retrieval interface. This mismatch is dangerous because users or higher-level orchestrators may grant camera, file, or report access under the assumption of narrow safety monitoring, while the code can process arbitrary inputs and expose unrelated analysis outputs.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The report listing/export feature exposes historical analysis artifacts that are not necessary for real-time UV safety intervention. If access controls are weak upstream, this broadens data exposure by allowing enumeration of prior analyses and retrieval of report image URLs, potentially leaking sensitive media-derived results.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The implementation does not contain UV-specific pet safety detection logic and instead delegates generic video analysis to an external skill API. In a safety-critical skill advertised as preventing UV exposure harm, this mismatch can mislead users into relying on protections that are not actually implemented, creating a dangerous false sense of safety.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is described as real-time active protection with automatic intervention, but this script only performs user-invoked CLI analysis and history listing. In the context of UV injury prevention, presenting offline analysis as active monitoring can delay or prevent timely shutdowns and alerts when a pet enters a hazardous area.

Context-Inappropriate Capability

Low
Confidence
75% confidence
Finding
The history lookup by open_id introduces access to user-associated analysis records that is not necessary for the stated pet UV safety function. If authorization is weak elsewhere in the stack, this capability could enable unintended access to another user's monitoring history or metadata, expanding privacy and abuse risk.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
This file exposes generic add/edit/delete/list wrappers plus arbitrary HTTP GET/POST/PUT/DELETE methods, which creates a broad capability surface unrelated to the stated UV pet safety-monitor function. In an agent skill context, overly broad network primitives can be repurposed to access unintended backend endpoints, exfiltrate data, or perform unauthorized state-changing actions if higher-level callers pass attacker-controlled URLs or parameters.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The get_user_by_username capability is not justified by the declared pet UV safety-monitor functionality and introduces access to user-account data in a skill that should focus on environmental safety events. In a plugin/agent setting, this kind of unrelated identity lookup increases the risk of account enumeration, privacy exposure, or pivoting into broader user-management functionality.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The configuration embeds tenant, platform, and application identifiers that are broader than what is needed for a UV pet-safety monitoring skill. While not a secret by itself, this exposes internal organizational metadata and cross-system linkage points that can aid reconnaissance, environment mapping, or accidental coupling to unrelated services.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This module defines a shared generic user/account persistence layer that is not clearly required for a UV pet-safety monitor. In a safety-monitoring skill, collecting and persisting unrelated account records expands the attack surface and increases privacy risk without an obvious functional need.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The User model stores identity and authentication-related fields such as username, realname, email, token, and open_token, but the stated UV disinfection pet-safety purpose does not justify handling that volume of sensitive personal and credential-like data. In the context of a home-monitoring safety skill, unnecessary token persistence materially increases privacy and account-compromise risk if the local database is accessed.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This utility performs generic remote account provisioning, token management, and API session handling that is unrelated to the declared UV pet-safety monitoring function. That mismatch is dangerous because it enables undisclosed external communications and identity creation, increasing the chance of covert data transfer, unauthorized account linkage, or unexpected persistence in a safety-focused skill where users would not expect such behavior.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code reads a local identity file, falls back to database lookup, and creates a persistent default user identifier when none exists. For a UV safety monitoring skill, persistent identity creation and reuse is functionally unrelated and risky because it silently establishes durable identity state that can later be used for tracking, remote API association, or unauthorized user-context carryover.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The utility discovers agent workspace layout and creates generic data and skills directories, capabilities broader than needed for a camera-based UV alerting skill. In context, this expands filesystem awareness and write capability in a way that could support persistence, cross-skill interaction, or environment enumeration beyond user expectations.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The default trigger is broad enough to activate on generic UV-related requests, potentially causing the skill to process attachments, call scripts, or query remote services when the user did not intend to invoke this functionality. Overbroad invocation increases the chance of accidental data exposure and unintended execution of risky capabilities.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill omits a clear privacy warning that user-provided videos/URLs may be sent to remote APIs or remotely downloaded by backend services. Users may reasonably believe analysis is local and may unknowingly disclose sensitive home-camera footage or network resources to third parties.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code reads arbitrary local file contents and transmits them to an analysis backend without any disclosure, consent prompt, or narrowing to the stated UV monitoring scenario. In the context of a safety-monitoring skill, this is more concerning because users may reasonably expect live camera/sensor processing rather than silent upload of arbitrary local files.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The debug log prints the full prompt contents, which may contain sensitive user inputs, internal instructions, API-derived data, or operational details. If debug logging is enabled and logs are collected centrally or exposed to operators, this creates an information disclosure path that can leak private or security-relevant data.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
When debug mode is enabled, the code turns on low-level HTTP and urllib3 logging, which can expose request metadata and potentially sensitive response content during operation. Because this module also handles tokens and identity-related requests, the debug path increases the risk of credential, identifier, or API data leakage through logs without explicit user warning.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2