T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/config-dev.yaml:2- Finding
Media, User Identifiers, and Authentication Data Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Pet Vocal Emotion Deep Classification | 宠物叫声情绪深度分类
Security checks for vulnerabilities and agentic risk
Overview
This pet-audio analysis skill needs Review because it silently links users to a cloud identity, stores reusable tokens locally, supports cloud history/report access, and ships plaintext development API endpoints.
Review before installing. Only use this skill if you accept uploading pet media or media URLs to the vendor cloud, linking requests to an internal user identity, retrieving cloud-stored history, and storing reusable service tokens in a local workspace database. The publisher should switch shipped defaults to HTTPS production endpoints, remove silent account creation where possible, document retention and history access clearly, and correct the dependency name before broad use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:586- Finding
Reusable Authentication Tokens Stored Unencrypted in a Local Database
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:37- Finding
Enabled Low-Level HTTP Debugging Can Leak Credentials and Request Content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
skills/smyx_analysis/requirements.txt:1- Finding
Ambiguous YAML Dependency Name Creates a Supply-Chain Resolution Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (63)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of HTTP communication, authentication/token handling, workspace writes, environment detection, identity resolution, registration/login, and local DB interaction is far broader than the manifest claims. This is dangerous because it creates hidden identity and data flows that users and platforms would not reasonably expect from an audio-only emotion-classification skill.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 82% confidence
- Finding
Metadata poisoning indicators in the manifest are suspicious because malformed or adversarial metadata can influence tool routing, parser behavior, or downstream safety logic. In this context, the issue is reinforced by the broader pattern of misrepresentation and inconsistent scope declarations.
- Content
md --- name: "smyx-vocal-emotion-classification-analysis" description: "Triggers when a user provides a pet vocalization audio/video URL or file for analysis; extracts acoustic features such as frequency, duration, interval, and harmonic structure via AI audio analysis, and classifies the vocalization into 6+ emotion categories (howling, growling, excitement, loneliness, fear, whining/coaxing) with confidence scores. Helps owners understand pet emotional states, improve human-pet interaction, and detect potential stress or health issues early. Application: daily companionship (smart camera / collar), boarding center mood monitoring, vet clinic calmin
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The HTTP helper automatically attaches tokens, API keys, authorization headers, tenant data, skill hub identifiers, and user identity fields to outbound requests. This is dangerous because callers may unknowingly transmit sensitive credentials and user identifiers to external services, which is especially misaligned with a skill that claims to only classify pet vocalizations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code automatically registers or logs in users against external platform services via /sys/phoneLogin, using generated or inferred identifiers without an explicit user action tied to the skill's stated function. In the context of an analysis-only pet-audio skill, this is overprivileged behavior that can silently create external accounts and transmit identity data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool/permission scope while its documented behavior requires shell execution, file read/write, environment access, and outbound network access. In an agent environment, this creates unnecessary ambiguity and can permit broader-than-expected capabilities, increasing the risk of data exfiltration, unsafe command execution, or misuse of local files.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation expands outputs from classification into structured reports, monitoring results, suggestions, and links, which conflicts with the narrow declared purpose. While less severe than hidden code paths, this still degrades informed consent and makes downstream policy enforcement harder.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The AI role says outputs should be limited to classification results and confidence, but other sections add risk prompts, suggestions, and report links. Conflicting operator instructions can cause unintended data disclosure or broader behavior than platform reviewers expect.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest promises only audio-based emotion-classification outputs, but the documentation also describes cloud history queries and report-link generation. This scope inconsistency is dangerous because it hides additional data-access behavior, which may expose user-linked report metadata and change the privacy profile of the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Automatically saving uploaded attachments as local files without a clear upfront warning creates a privacy and data-retention risk. Users may believe files are processed transiently, while the skill actually creates persistent local artifacts that could later be accessed by other components or leaked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill omits a clear warning that historical reports are fetched from a cloud API and may reveal user-linked analysis data. This matters because cloud lookups change the trust boundary and can expose more personal or sensitive history than the user intended in the current interaction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented endpoints expose historical report pagination and full report export capabilities that exceed the manifest’s stated scope of returning only vocal emotion classification results with confidence. This scope mismatch can enable unintended access to stored analyses or richer report data, increasing the risk of privacy leakage, overcollection, or unauthorized retrieval if these endpoints are wired into the skill without strict authorization and disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises single audio/video emotion classification, but the code also exposes a history-listing function tied to an internal user identifier. That expands data access beyond the declared purpose and can reveal prior analysis records if invoked by unauthorized users or by callers who were not expecting any account-scoped retrieval capability.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code initializes and relies on an internal open_id capability even though the stated function is only to analyze a provided file or URL. Introducing hidden identity resolution creates an unnecessary link between content analysis and user identity, increasing privacy risk and enabling access to account-scoped data such as historical reports without clear user awareness or need.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Static analysis
Detected: suspicious.install_untrusted_source
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- skills/smyx_common/scripts/config-dev.yaml:2