ClawHub
Back to skill

Security audit

Pet Vocal Emotion Deep Classification | 宠物叫声情绪深度分类

Security checks across malware telemetry and agentic risk

Overview

This pet-audio classifier needs review because it silently creates or reuses an identity, stores account tokens locally, and contacts cloud or development endpoints for analysis and history features.

Install only if you are comfortable with the skill sending pet media or media URLs to its backend, silently associating runs with a local or platform identity, creating/reusing a cloud account, storing returned tokens in a workspace SQLite database, and querying prior reports from the cloud. The dev-host default configuration and hidden identity/API-key handling should be clarified or fixed before routine use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
85% confidence
Finding
This method accepts arbitrary keys from the filters dict and resolves them against the model with getattr(self.__model__, key). While SQLAlchemy prevents classic SQL injection here, untrusted callers can still probe model structure, trigger exceptions on invalid attributes, and query on unintended sensitive fields, creating an authorization and data-exposure risk in a generic DAO.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
As in list(), count() accepts arbitrary filter keys and dynamically maps them to model attributes. Even without raw SQL injection, this can enable unauthorized metadata discovery and counting of records by sensitive fields, which is useful for enumeration and privacy inference.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises no explicit permissions while its documented behavior invokes shell commands, local file save operations, network access, and likely local state handling. This is dangerous because it hides the real execution and data-handling surface from reviewers and users, making risky capabilities easier to deploy without informed approval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented behavior materially exceeds the stated purpose by implicitly creating or reusing identities, storing tokens/profile data locally, contacting remote login endpoints, and exposing historical-report features. That mismatch is dangerous because users invoking a simple pet-audio classifier may unknowingly trigger account creation, data persistence, and remote transmission of personal or session-linked information.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The documentation expands the skill from narrow audio emotion classification into broader media analysis, cloud report retrieval, and recommendation/report-link output. Scope expansion increases the attack and privacy surface because the skill can process more input types and interact with remote report systems beyond what a user may reasonably expect from the title and summary.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill exposes a history-listing capability tied to an internal user identity, which goes beyond the manifest’s stated purpose of analyzing a single provided pet vocalization. This creates an unnecessary data-access surface and could allow retrieval of prior analysis records if identity handling or authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code silently resolves and uses an internal OpenID-style identity for report access, even though identity-bound data access is not needed for basic audio emotion classification. Hidden identity resolution increases privacy and authorization risk, especially when combined with listing/report retrieval functions that may expose stored user data.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill exposes report-history listing and adds export-image URLs for prior analyses, which goes beyond the declared function of classifying a user-provided pet vocalization and returning the current result. If these records are accessible without strong authorization scoping, users may enumerate or retrieve prior reports, creating unnecessary data exposure and privacy risk.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This file exposes generic add/edit/delete/list plus arbitrary HTTP GET/POST/PUT/DELETE wrappers that are broader than the declared pet vocal emotion classification purpose. In a skill that should only analyze provided audio/video inputs, these reusable network primitives expand the attack surface and can enable unintended external interactions or data access if higher-level code passes untrusted URLs or parameters.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The http_post/http_put/http_get/http_delete methods accept arbitrary URL arguments and directly forward requests, which creates unjustified network reachability for this skill. If any user-controlled or indirectly influenced input reaches these wrappers, the skill could be abused for unauthorized outbound requests, data exfiltration, or access to internal services depending on runtime network placement.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements a general-purpose persistence layer for user/account records, including create, update, delete, lookup, and counting operations, which is far beyond the declared role of an audio-only pet emotion classifier. In this skill context, such hidden stateful identity management materially increases attack surface and raises strong concerns about overcollection, unauthorized retention, and misuse of unrelated user data.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The User model stores identity and authentication-adjacent fields such as username, realname, email, token, and open_token, none of which are justified by a pet vocalization emotion-classification feature. In this context, collecting and mutating those fields creates unnecessary privacy and credential-handling risk, especially because the DAO exposes broad CRUD operations over them.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This utility file contains account bootstrap, implicit user creation, token acquisition, and remote login/registration logic that is unrelated to the declared pet vocal emotion analysis purpose. Hidden identity provisioning and outbound authentication materially expand the skill's privileges and allow undisclosed linkage of local workspace identities to remote services, which is especially risky in an audio-analysis skill where users would not expect account operations.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code performs agent/workspace discovery and creates data and skills directories, capabilities that exceed the stated function of classifying pet vocalizations. While not directly exploit code, it broadens filesystem awareness and enables the skill to locate or persist data across agent workspaces, increasing the blast radius for privacy or supply-chain abuse if combined with other functions.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger language is broad enough to auto-activate on ordinary media-sharing or general pet-emotion requests without strong scoping constraints. Overbroad triggering is dangerous in an agent environment because it can cause unintended local file handling, remote URL processing, or cloud API calls in contexts where the user did not intend to invoke this skill.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that uploaded attachments or media files are automatically saved locally, but it does not clearly warn users about local persistence, retention, or security controls. Silent local storage is dangerous because uploaded media may contain sensitive content or metadata and can remain accessible on disk beyond the immediate task.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script initializes an internal identity through a hidden --open-id mechanism and suppresses its help text, reducing transparency about how user-linked data is accessed. Hidden account-context behavior can enable unauthorized or confusing access patterns and makes security review and user consent more difficult.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script accepts a hidden `--api-key` parameter while suppressing it from help output, which obscures credential handling from users and reviewers. Hidden credential inputs increase the chance of insecure use, accidental leakage via process arguments, and undisclosed transmission to remote services, especially in a skill that processes user-supplied media/URLs through backend APIs.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill reads a sensitive identity value from a workspace file and uses it as an internal identifier without user-facing disclosure or consent. This creates a covert identity source that can silently bind skill activity to a persistent account, which is inappropriate and privacy-impacting in the context of a pet emotion analysis tool.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
This request flow transmits openId, mobile, and source fields to a remote login endpoint without user-facing disclosure, and does so as part of automatic account bootstrap logic. Undisclosed transmission of identity data is a serious privacy and trust violation, made more concerning because it is unrelated to the advertised pet vocalization classification behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
This line performs outbound transmission to a remote service as part of implicit login/registration. External transmission is expected for some cloud-backed skills, but here the transmitted payload includes identity-related fields and is not aligned with the stated pet audio analysis purpose, making the behavior materially more dangerous.

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 mp3/wav/m4a 音频或 mp4/avi/mov 视频格式，最大 10MB |
| 🔎 使用提醒 | 推荐音频时长 1～30 秒；过短/过长可能影响分类置信度 |
| 🧑‍⚖️ 结果性质 | 分析结果仅作情绪参考，不提供医疗、训练或行为矫正建议 |
| 🔎 使用提醒 | 若叫声混杂多种情绪或背景噪声过大，可能返回 "low_confidence" |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，API 服务会自动下载 |
Confidence
67% confidence
Finding
The hidden-instructions indicator suggests the document may contain invisible or obfuscated control text. In an agent skill, concealed instructions are dangerous because they can bypass normal reviewer scrutiny and alter tool behavior, constraints, or data-handling expectations in ways that are not obvious from visible content.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-vocal-emotion-classification-analysis"
description: "Triggers when a user provides a pet vocalization audio/video URL or file for analysis; extracts acoustic features such as frequency, duration, interval, and harmonic structure via AI audio analysis, and classifies the vocalization into 6+ emotion categories (howling, growling, excitement, loneliness, fear, whining/coaxing) with confidence scores. Helps owners understand pet emotional states, improve human-pet interaction, and detect potential stress or health issues early. Application: daily companionship (smart camera / collar), boarding center mood monitoring, vet clinic calming assessment, behavior training assistance. Does NOT provide medical or behavior-modification advice — only outputs audio-based emotion classification results with confidence. | 当用户提供宠物（犬/猫）叫声音频或视频URL/文件时，触发本技能进行叫声情绪深度分类分析；利用AI音频分析技术提取频率、时长、间隔、谐波结构等声学特征，将叫声分类为哀嚎、低吼、兴奋、孤独、恐惧、撒娇等6种以上情绪类别，并输出置信度；帮助宠物主人理解宠物情绪状态，改善人宠互动，及时发现潜在压力或健康问题。应用场景：宠物家庭日常陪伴（智能摄像头/项圈）、寄养中心情绪监测、宠物医院安抚评估、行为训练辅助。仅输出基于音频的情绪分类结果及置信度，不提供医疗或行为矫正建议。"
version: "1.0.12"
license: "MIT-0"
---
Confidence
80% confidence
Finding
The metadata poisoning indicator is credible in this context because the skill manifest mixes operational instructions, broad behavior claims, and hidden-instruction signals in a way that can influence agent routing and trust decisions. Poisoned or misleading metadata is dangerous because agents may grant execution paths or interpret scope based on adversarial manifest text rather than trustworthy policy.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2