Vocalization Health Analysis | 畜禽声纹健康分析

• Outcome: Review
• Latest audit: Aug 18, 2026 · 3:04 PM UTC
• Version: 1.0.9

Overview

The skill performs the advertised cloud-based media analysis, but it also silently creates or reuses an identity, contacts backend services, and stores account tokens/profile data with limited user control.

Install only if you are comfortable with cloud processing of submitted media, automatic backend identity/account handling, and local storage of session tokens/profile data. Review the backend configuration and clear or manage the workspace data database if you do not want persistent identity reuse.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 78% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 78% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, file I/O, and likely environment-backed identity handling, yet declares no explicit permissions. This creates a transparency and policy-enforcement gap: users and the hosting platform may underestimate the skill’s real access level, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The manifest frames the skill as a focused livestock vocalization analyzer, but the documented behavior includes remote media submission, identity resolution, report retrieval, and link generation through a generic backend service. This mismatch can mislead users about what data leaves the system and what secondary actions occur, undermining informed consent and increasing privacy and data-handling risk.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script exposes a history-listing function via `--list` that retrieves prior analysis reports by `open_id`, which goes beyond the declared analysis-only behavior in the manifest. Even though this file does not itself implement authorization, adding undisclosed report enumeration expands data access scope and can expose prior user or tenant data if identity handling is weak elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script silently resolves an internal `open_id` through `OpenIdUtil.resolve_current_open_id` while suppressing the related CLI help, which introduces hidden identity handling unrelated to simple audio analysis. This is dangerous because it can bind operations and report access to an internal identity context without explicit user awareness, increasing the chance of unauthorized data access, privacy issues, or confused-deputy behavior.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially diverges from the declared skill purpose: it operates as a generic video-analysis and history-listing CLI rather than a livestock vocalization health analyzer. This kind of capability mismatch is dangerous because it can mislead users about what data is processed and where it is sent, defeating informed consent and security review assumptions for the skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The `--list`/history feature introduces access to prior analysis records that is not justified by the stated purpose of single-item vocalization analysis. Extra data-access functionality broadens the attack surface and may expose historical user or tenant data if authorization boundaries in downstream components are weak or misconfigured.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: User-facing strings and function descriptions repeatedly describe a generic video-analysis tool, contradicting the advertised purpose of animal vocalization health analysis. This inconsistency is a security issue because reviewers and users may trust the manifest while the script performs broader media-processing behavior, enabling undeclared data handling and policy bypass.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This service exposes generic CRUD and arbitrary HTTP wrapper methods (http_get/http_post/http_put/http_delete, add/edit/delete/list/page) that are not narrowly scoped to livestock vocalization health analysis. In an agent-skill context, these broad network capabilities can be repurposed to access or modify unrelated backend resources, increasing the risk of data exfiltration, unintended side effects, or abuse if higher-level controls are weak or prompt-influenced.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This skill is supposed to analyze livestock and poultry vocalizations, yet the module persists generic user/account records. That mismatch indicates unnecessary identity/account handling in a domain that does not require it, increasing attack surface and creating avoidable exposure of user data within a health-analysis skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The model stores authentication-related tokens plus personal profile data such as username, realname, email, birthday, age, and sex, none of which are justified by livestock vocalization health analysis. Collecting and locally persisting this data creates a materially larger privacy and credential-risk surface, especially because tokens are stored as plain database fields without any visible encryption, scoping, or retention controls.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes a general-purpose `ai_chat` helper that is not constrained to the advertised livestock vocalization health-analysis purpose. In an agent/plugin environment, this broadens the skill’s effective capability surface and can enable prompt handling, data exfiltration, or policy bypass through a generic chat interface unrelated to the declared function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility code performs remote account provisioning, token acquisition, and authenticated API session setup, which is materially broader than the declared purpose of livestock vocalization health analysis. That creates hidden identity and account side effects, can transmit user-linked identifiers off-box, and expands the attack surface to remote services without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads, generates, persists, and reuses open-id and user identity state unrelated to simple acoustic analysis. Hidden credential and identity lifecycle management increases privacy risk, enables cross-run tracking, and can silently bind later requests to a persistent account without the user's awareness.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The utility inspects workspace paths, environment variables, and agent layout, then creates shared data and skills directories as a generic capability. For a narrowly described vocalization-analysis skill, this is unnecessary breadth that can facilitate persistence, environmental discovery, and modification of the local agent workspace beyond user expectations.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The history-report auto-trigger language is broad enough that ordinary user phrasing could invoke cloud history queries without a clearly intentional request. In a skill that auto-associates identity and accesses prior reports, ambiguous activation raises the risk of unintended retrieval of potentially sensitive operational records.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code reads the entire local file into memory and uploads it to an external analysis service via the `files` parameter, but this file contains no user-facing disclosure, confirmation, or minimization step before transmission. In a health-analysis context involving farm recordings, uploaded media may contain sensitive operational, location, or incidental human data, so silent exfiltration to a remote service creates a real privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The script accepts local file paths or remote URLs and forwards them to a backend analysis function without any explicit user warning about transmission or processing location. In the context of a misrepresented skill, this is more concerning because users may believe they are performing local livestock-audio analysis while actually causing external processing of potentially sensitive media references.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The debug log prints the full `prompt` content, which may contain sensitive user data, operational instructions, or proprietary information. If debug logging is enabled in production or logs are centrally collected, this can expose confidential data to operators, log processors, or attackers with log access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Reading a workspace API key file to derive an internal identity without user-facing disclosure is a privacy and secret-handling issue. It can silently appropriate existing credentials or identifiers from the environment and use them for subsequent remote actions, violating least surprise and least privilege.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code automatically performs network login/registration and transmits identity fields such as openId and mobile without user-facing warning. In the context of a health-analysis skill, this hidden outbound identity transmission is especially dangerous because it is unrelated to the advertised function and can create accounts or leak identifiers to an external service.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: Automatically creating a generic skills directory is more sensitive than creating a data directory because it prepares a location associated with code/skill installation and persistence. In an unrelated analysis skill, this broadens local modification capability and can support undeclared expansion of the runtime environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 音频支持 `wav` / `mp3` / `m4a` / `aac`；视频支持 `mp4` / `avi` / `mov`；单文件最大 `10MB` |
| 🧑‍⚖️ 结果性质 | 分析结果仅供群体呼吸道健康筛查参考，本技能不提供疾病诊断或治疗建议 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 83% confidence
• Finding: ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2