Security audit
Security checks for vulnerabilities and agentic risk
This is a real desktop pet, but it has undisclosed file, credential, and network behaviors that users should review before running it.
Review this before installing or running. The pet UI is legitimate, but the script should be treated as networked software: it can download assets, poll third-party services, read nearby identity/profile files, use NBW_API_KEY, and send chat context to a cloud endpoint. Prefer a version that bundles assets, removes parent-directory identity reads, enables network features only after clear consent, verifies TLS normally, and documents all endpoints and transmitted data.
scripts/desktop_pet.py:495Undisclosed collection and transmission of local identity data, chat content, and API credentials
scripts/desktop_pet.py:617TLS certificate and hostname verification disabled for background network requests
scripts/desktop_pet.py:6Automatic download of unpinned mutable assets without integrity verification
SKILL.md:9Security-relevant runtime behavior is materially omitted from the Skill documentation
The declared purpose is a local desktop pet, but the detected behavior includes downloading assets, reading local identity files, accessing environment secrets, persisting data, and exfiltrating prompts/chat history to a remote AI endpoint. That is a severe description-behavior mismatch because users invoking a harmless pet app would not reasonably expect local data harvesting, secret access, or transmission of sensitive content off-device.
Referenced artifact was not completely inspected
1. Copy `scripts/desktop_pet.py` to target directory
Referenced artifact was not completely inspected
1. Copy `scripts/desktop_pet.py` to target directory
The skill is presented as a local desktop pet, but it automatically performs external network activity at startup and in the background, including downloading assets and contacting third-party services. This expands the trust boundary significantly: remote content can change over time, creates supply-chain exposure, and leaks usage metadata without being necessary for basic local pet rendering.
User-entered chat messages, conversation history, and pet state are sent to a remote AI endpoint that is unrelated to the stated local desktop-pet purpose. This creates a real data exfiltration path to a third party, especially because locally harvested personalization data and ongoing conversation history may be included without meaningful disclosure.
The skill metadata declares no explicit tool scope even though the detected behavior includes file access, file writes, and network use. Missing permission boundaries can cause an agent to invoke this skill in contexts where users do not expect data access or outbound communication, increasing the chance of over-privileged execution.
The invocation text says to use the skill when the user asks to create a "desktop pet, virtual pet, pixel pet, tamagotchi-like app". Several of these phrases, especially "virtual pet" and "pixel pet", are broad and the file does not provide exclusion conditions or negative examples, which increases the chance of unintended activation for loosely related app requests.
The code reads local IDENTITY.md and USER.md files to personalize behavior, even though that data access is not required for a desktop pet's core function. This can unexpectedly ingest personal profile data from nearby directories and expose or reuse it in UI or downstream network calls, violating least privilege.
The background news collection feature fetches trending topics from external services even though it is not necessary for a desktop pet. Besides increasing attack surface and metadata leakage, it introduces undeclared third-party dependencies and allows remote content to influence pet behavior and displayed text.
The system prompt explicitly instructs the model to '用中文' for replies, which imposes a fixed language policy. There is no opt-in, language selection mechanism, or documented regional justification in this file, so it conflicts with the requirement not to force a specific language or locale without user choice.
The program transmits user chat content and conversation history to an external AI service without a clear warning at the point of use. Even if the feature is user-triggered, the lack of explicit notice and consent means sensitive text may be sent off-device unexpectedly.
The skill description and title include Chinese and Japanese text alongside English, including quoted trigger phrases and the title "南波万の小家园", but the document does not state that multilingual behavior is optional or user-selected. This can violate a language/locale policy when a skill implicitly imposes a locale presentation without explicit user opt-in or justification.
The program automatically downloads assets from GitHub on first run without explicit user consent or integrity verification. While the files are images, this still creates supply-chain and privacy risks because remote content can change and the request reveals environment/network metadata.
The inline comments state the code uses a Baidu hot-search API and then references another aggregated free API, but the actual request performed is to https://weibo.com/ajax/statuses/hot_band. This is active documentation contradiction about what external source the code contacts.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
on_click(e)
# 如果小卖部/档案等子窗口开着，保持它们在前面
for attr in ('_shop_win','_profile_win','_travel_win'):
sub = getattr(self, attr, None)
if sub and sub.winfo_exists():
sub.lift()
cv_g.bind('<Button-1>', lambda e: (_garden_click(e), None))
No suspicious patterns detected.