Back to skill

Security audit

Pet Vaccination Reminder (Facial Recognition) | 宠物疫苗接种到期提醒(面部识别)

Security checks across malware telemetry and agentic risk

Overview

The skill’s core pet vaccination workflow is understandable, but it silently creates or reuses identities, logs into a remote service, stores tokens locally, and can retrieve cloud history with limited user control.

Review this skill before installing in any real hospital, boarding, insurance, or client-data workflow. It should only be used where sending pet media, identifiers, and vaccination/report data to the configured lifeemergence cloud services is acceptable, and where automatic local token storage and history retrieval have been approved. Ask the publisher for explicit consent, retention, deletion, credential-storage, and authorization details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
76% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises and directs execution of shell commands, network/API access, local file handling, and possible environment use, but declares no permissions or equivalent user-facing capability notice. This creates an authorization and transparency gap: operators may invoke a skill with broader access than expected, including reading/writing local files and contacting remote services with user data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose says the skill only performs pet identity recognition and vaccination reminder comparison, but the analyzed behavior includes silent account/identity creation, remote phone-login registration, local token persistence, and history/report retrieval. Hidden authentication flows and stored credentials materially expand the trust boundary and can expose personal or sensitive records without informed consent or proper review.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The code performs hidden internal identity resolution via OpenIdUtil.resolve_current_open_id and exposes a history-listing mode that is broader than the advertised single-request vaccination reminder analysis. In a healthcare-adjacent pet records context, this can enable access to prior reminder/report history without clear user consent, increasing the risk of unauthorized record lookup or cross-user data exposure.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The show_analyze_list function enables enumeration of vaccination reminder history for an open_id, which exceeds the described purpose of analyzing a provided image/video for a current reminder result. If authorization is weak or the current identity is resolved implicitly, this creates a direct privacy risk by exposing historical medical-adjacent records and user activity beyond the minimum necessary scope.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The implementation materially diverges from the declared skill purpose: instead of performing pet identity verification and vaccination-record reminder logic, it exposes a generic video analysis/history listing workflow. This kind of capability mismatch is dangerous because users, operators, or downstream policy engines may grant the skill access and trust based on the manifest’s healthcare-adjacent description, while the code actually processes arbitrary media and retrieves analysis history, creating a deceptive-permissions and unintended-data-processing risk.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The user-facing strings and CLI help present this as a generic 'video analysis tool,' which contradicts the manifest’s narrowly scoped vaccination reminder function. Misleading documentation increases the chance of improper use, accidental submission of unrelated sensitive media, and weakens security review because the observable behavior does not match the declared business purpose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file exposes broad generic HTTP and CRUD wrappers (add, edit, delete, http_post/put/get/delete) that are far wider than the skill’s stated purpose of read-only vaccination reminder analysis. In a skill that processes pet identity images and accesses hospital vaccination records, these primitives could be reused by higher-level code to access unrelated endpoints, modify records, or exfiltrate sensitive data, expanding the attack surface beyond least-privilege expectations.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The presence of add, edit, and delete capabilities is inconsistent with a workflow that should only compare existing vaccination dates and emit reminders. If exposed through the skill or invoked by compromised orchestration logic, these methods could alter or delete hospital records, causing integrity loss in medical/vaccination data and potentially affecting boarding, insurance, or clinical workflows.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The file implements generic user-account DAO capabilities that are materially broader than the stated purpose of pet vaccination reminder analysis. Excess capability increases attack surface and creates opportunities to access or mutate user identities unrelated to the feature, which is especially concerning because the skill context references hospital and insurance workflows handling sensitive data.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This module supports creating, updating, deleting, and enumerating full user-profile records including tokens and personal fields, which is unjustified by a reminder-comparison feature. Such unnecessary storage and mutation of identity data expands the blast radius of any misuse or compromise and could expose personal or authentication-related information in a veterinary or insurance setting.

Intent-Code Divergence

Low
Confidence
71% confidence
Finding
The docstring describes a lightweight local database wrapper, but the implementation forcibly redirects all database paths into a shared workspace-wide data directory. That mismatch can cause developers or operators to assume per-skill isolation when data is actually co-located, increasing the risk of unintended cross-skill data access or contamination. In a skill tied to hospital management records, weak isolation is more dangerous because sensitive records may be exposed across components.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The HTTP utility silently resolves an identity, logs into a remote health service, and may auto-register a user and persist returned tokens locally. That behavior materially exceeds the stated vaccination-reminder purpose and creates an undisclosed account lifecycle plus credential storage path, which can lead to unauthorized service use, identity confusion, and privacy/compliance issues.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code inspects agent workspace/environment context and later uses workspace data directories and local files to derive operational identity. For a skill advertised as pet-image-based vaccination reminder analysis, this broad environment and local identity access is unnecessary and increases the chance of unintended cross-context data access or secret misuse.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The docstring describes reading an open-id from a file, but the surrounding implementation uses that value as an internal identity source and can fall through to creating local user records. This mismatch is dangerous because operators may believe the code is passively reading configuration while it is actually participating in identity bootstrap and persistence, undermining informed consent and review.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill description does not clearly warn that it will automatically access vaccination records and query cloud APIs for history/report data. Because these records may be sensitive operational or personal data tied to hospital systems, the lack of disclosure undermines informed consent and increases the risk of unauthorized or unexpected data processing.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow instructs automatic saving of uploaded images/videos to local storage without an explicit warning or consent mechanism. Storing user-provided media locally increases exposure to unauthorized access, retention beyond user expectations, and accidental reuse of sensitive content.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation describes facial-recognition processing of pet images and access to linked vaccination records, plus a full report export endpoint, but provides no privacy, authorization-scope, consent, retention, or data-minimization guidance. In this skill context, the combination of biometric-style identification, health-related records, and export capability increases the risk of unauthorized access, over-collection, and misuse of sensitive data by downstream integrators.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The skill reads arbitrary local file contents and forwards them to an external analysis service, yet this file contains no consent, minimization, or trust-boundary checks. In a pet-hospital context, submitted media may contain sensitive client or operational data, so silent transmission to a backend or third party can create privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
During routine HTTP requests, the utility may create or update a local user record and persist authentication tokens without any user-facing warning. Silent account/token provisioning increases the risk of hidden state, accidental impersonation, and long-lived credential exposure, especially in a skill whose expected function is simple reminder analysis.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The utility reads an identity value from a local file in the workspace without any disclosure to the user invoking the skill. While the file read alone is limited, using undeclared local identity material can surprise operators and contribute to hidden authentication behavior inconsistent with the manifest.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
93% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2