Pet UV Safety Monitor Analysis | 宠物紫外线消毒安全监测

• Outcome: Review
• Latest audit: Oct 27, 2026 · 12:41 AM UTC
• Version: 1.0.13

Overview

Review is needed because automatic UV-lamp protection is unsupported, an export-only option still runs analysis, and configured API secrets can be transmitted as account identifiers.

Do not rely on this skill to protect pets or confirm that a UV lamp is off. Before installing, seek fixes for export-only handling and secret reuse, and clarification of cloud footage retention and local token storage. The evidence supports Review, rather than a malware finding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (28)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement the declared safety-monitoring workflow. Its only substantive method is an unfinished generic chat helper, and the commented subprocess code does not execute. Imported base classes may contain additional behavior, but their implementations are not supplied, so they cannot establish the claimed monitoring capabilities. This assessment is limited to the provided chunk; it does not infer malicious behavior or actual external command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code's implemented purpose is user-data persistence, not pet UV-C safety monitoring. Database storage could support the declared event-logging feature, but this chunk specifically manages sys_user records, including names, email addresses, birthdays, and tokens; it contains no exposure-event model or monitoring logic. This is a material mismatch in the supplied chunk, although other, unprovided code could implement the advertised monitoring features. The chunk does not demonstrate external data collection or exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill advertises real-time monitoring and automatic protective actions, but its documented executable workflow only submits videos and retrieves reports without establishing continuous monitoring or an actuator connection. In this physical-safety context, users could rely on protection that has not been demonstrated and leave pets exposed to an active UV-C lamp.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The real-time protection claims conflict with the documented on-demand workflow, and the notification example asserts that the lamp has been shut off without specifying verified shutdown feedback. However, the finding's assertion that history retrieval is undisclosed is incorrect: history querying and automatic identity association are explicitly documented.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The reported attachment of authentication and identity information to caller-supplied absolute URLs creates a concrete credential-disclosure risk if those URLs can target an untrusted origin. Automatic account initialization is disclosed, but it does not authorize forwarding credentials to arbitrary destinations; the underlying code was not supplied, so this behavior still requires source verification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The strongest mismatch is the explicit health-order report-export configuration, which is not explained by the declared safety-monitoring purpose. Generic AI-analysis configuration could support that purpose, but this chunk supplies no such linkage. This assessment is limited to the supplied configuration code: it does not establish that reports are actually exported or that monitoring functionality is absent elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Generic HTTP helpers could support the declared smart-home integration and are not inherently a mismatch. However, the supplied chunk also exposes user-directory lookup and storage-download functionality that the description does not account for. It contains no pet detection, UV-state analysis, safety decision logic, alerts, lamp control, or event logging. This assessment is limited to the supplied chunk; it does not establish what other files implement or imply that these methods execute automatically.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-uv-safety-monitor-analysis"
description: "AI-powered UV disinfection safety monitor for pets. Real-time camera analysis detects whether a pet enters an active UV-C disinfection zone and whether the UV lamp is on (via blue-purple glow recognition or smart-home API linkage). When both conditions are met, it auto-triggers a high-risk alert, recommends shutting off the UV lamp, and logs the event to prevent corneal burns or skin damage. Scenarios: smart homes, pet households, pet boarding facilities. | 通过智能家居摄像头实时识别宠物是否进入正在进行紫外线消毒的区域，自动关闭UV灯并推送�

The implemented workflow returns a video-analysis report rather than providing the advertised active UV safety monitoring and response.

High

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The shown workflow submits a video for analysis, polls for a report, and formats the result; it does not implement continuous monitoring, an explicit hazard-triggered alert, or UV-lamp shutdown. In a physical-safety skill, users relying on the advertised active protection could leave pets exposed to UV-C while receiving only retrospective analysis; unshown API implementations might provide additional behavior, but this file does not establish those protections.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The analysis workflow lacks a privacy warning about sending indoor camera footage to an external API.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The workflow sends indoor camera footage to a cloud analysis service without a clear privacy notice or an explicit external-processing consent step. Although API use is mentioned, users are not told who receives potentially sensitive household footage, how long it is retained, or how automatically associated reports are protected.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to run analysis, but the flag is ignored and normal analysis still executes.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The program accepts --export-env-only but never checks it, so providing an input alongside this flag still invokes identity resolution and skill.get_output_analysis despite the explicit promise not to run analysis. For a skill handling private home-camera footage, this can cause unintended processing and potentially remote transmission, although the supplied file does not establish what the downstream implementation actually does.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are passed to the analysis API without disclosure of the upload.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The code reads the complete local video and passes its contents to the analysis API without an upload disclosure or consent check in the shown workflow. Home and boarding-facility camera footage can reveal occupants, interiors, and routines, making undisclosed external processing a privacy risk; the destination, transport protections, and any consent elsewhere cannot be determined from this file.

Content

No source excerpt is available for this finding.

--export-env-only promises not to run analysis, but analysis still executes when an input is supplied.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag explicitly promises not to execute analysis, but its parsed value is never checked, so providing an input still invokes skill.get_output_analysis. This violates the user's execution boundary and could cause unintended processing, external transmission, or API charges, depending on the downstream implementation. The home-camera and pet-monitoring context increases privacy concerns because footage may expose occupants and private spaces; the supplied code does not establish whether transmission or device control actually occurs.

Content

No source excerpt is available for this finding.

The DAO implements persistent demographic user-profile management beyond UV safety monitoring.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The User model stores real names, email addresses, birthdays, sex, and age, and UserDao exposes inherited CRUD operations over those profiles (L448–L473). DAO initialization also creates and migrates the sys_user table (L185–L215), making this an implemented persistence capability rather than unused field documentation. Although smart-home linkage can justify integration tokens, demographic profile management is not justified by the stated pet detection, lamp control, alerting, or event-logging purpose.

Content

No source excerpt is available for this finding.

ai_chat documents agent-based analysis but never invokes the agent or returns an analysis result.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The agent invocation is commented out, and accessing result.stderr on an empty dictionary always raises AttributeError; the broad exception handler suppresses the failure and implicitly returns None, with diagnostics only in debug mode. In a UV-C safety monitor, this silent loss of analysis could prevent hazard detection or alerts if callers rely on this method without treating missing results as a fault, although the supplied file does not establish that execution path.

Content

No source excerpt is available for this finding.

FileUtil.open silently truncates existing files without disclosing its destructive behavior.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

The generically named open helper opens the supplied path in 'w' mode, immediately erasing existing contents even before the caller writes anything. There is no confirmation, action log, docstring, or comment explaining this destructive behavior; exception tracing only runs after a failure.

Content

No source excerpt is available for this finding.

The request helper silently registers remote accounts and persists user profiles, capabilities outside the UV safety monitor's stated purpose.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

Remote account provisioning is not inherently a vulnerability, but this flow can select API_SECRET_KEY as the username, transmit it as both openId and mobile, and subsequently use it for local user lookup. This repurposes a credential as identity/profile data, potentially exposing it to account storage and logging systems beyond the intended authentication channel; no malicious destination or intent is established.

Content

No source excerpt is available for this finding.

Ordinary HTTP requests can silently transmit an identity and register a remote account.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

An ordinary request can trigger a separate login/registration request when tokens are absent, automatically transmitting the selected identity. Because that identity can be API_SECRET_KEY, the concrete concern is undisclosed credential propagation into account identity fields, not merely the existence of automatic authentication; this overlaps with SDI-2.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

External HTTP transmission is expected for a connected safety monitor and is not independently suspicious. However, this specific POST can carry API_SECRET_KEY in the mobile and openId JSON fields, establishing the transmission sink for the credential/identity conflation described above; the supplied file does not establish whether the configured endpoint uses HTTPS.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and writes missing configuration files.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

YamlUtil.load creates parent directories and writes a YAML file when the requested path does not exist, without a comment, docstring, prompt, or log disclosing this side effect. BaseEnum.init_subclass invokes this loader during class definition (L053 and L058), so importing the module can modify the filesystem without an explicit save request.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)