Back to skill

Security audit

Plant Species test

Security checks across malware telemetry and agentic risk

Overview

This skill does perform plant-related cloud analysis, but it also silently links users to cloud accounts, retrieves report history, and stores local identity tokens in ways that need review before installation.

Review before installing. Treat this as a cloud/account-linked media analysis skill, not just a local plant identifier. Confirm what identity it will use, whether it can create a remote account, where local tokens are stored, how history reports are accessed or deleted, and whether users can opt out of cloud history and local credential persistence.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill manifest advertises a simple plant-recognition capability, but the documented behavior invokes shell commands, performs file read/write, uses network access, and appears to rely on environment-backed identity handling without declaring those capabilities. This is dangerous because it expands the attack surface well beyond user-visible expectations and makes sensitive operations harder to govern, audit, and sandbox.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is plant species identification, but the skill also includes cloud history retrieval, report-link generation, backend user/login/token handling, and local user persistence. That mismatch is dangerous because users and reviewers may approve the skill for low-risk image analysis while it quietly performs account-linked data access and persistence unrelated to the core task.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The manifest frames the skill as recognition, but the documentation adds cloud retrieval of historical reports and report-link output. This broadens the data-access scope from analysis of provided inputs to retrieval of prior account-associated records, which can expose sensitive historical data if triggered unexpectedly.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The function exposes a user-specific analysis listing capability that is unrelated to plant image recognition and broadens the skill’s data-access surface. In the context of a narrowly scoped recognition skill, adding history/listing behavior can enable unauthorized access to prior analysis records if caller identity or authorization is weak elsewhere.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Resolving an internal user identity in a plant-recognition CLI introduces hidden identity coupling unrelated to the advertised function of analyzing an image. This creates unnecessary linkage between content analysis and user identity, which increases privacy risk and can become an access-control issue when combined with account-scoped listing or stored results.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation materially contradicts the declared plant-species recognition purpose and instead performs generic remote analysis/report handling for local files or URLs, including explicit video-oriented paths and polling for reports. This kind of capability mismatch is dangerous because users may believe they are invoking a narrowly scoped botanical classifier while the skill actually uploads arbitrary content to a backend analysis service, increasing the risk of deceptive data exfiltration or unauthorized processing under false pretenses.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The validation/error text tells users to provide a local video path or network video URL, which conflicts with the skill's stated image-based plant recognition function. While this is partly a product-integrity issue, in a security context it signals scope mismatch and can mislead users into submitting unintended media types to a remote service, reducing informed consent and hiding the true behavior of the skill.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially diverges from the manifest: it is a video-analysis CLI that accepts local paths and remote URLs, rather than a plant-species image recognizer. This kind of scope mismatch is dangerous because users and platform controls may grant trust, permissions, or review leniency based on the declared purpose, while the code performs unrelated media processing and backend interaction.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill exposes history/listing behavior via `--list` and `show_analyze_list(open_id)` that is outside the stated plant-recognition scope. Hidden or undocumented access to historical analysis data increases the risk of unexpected data exposure, especially because users would not reasonably expect a plant-identification tool to enumerate prior video analysis records.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code imports and uses OpenID-based identity resolution in a skill whose declared purpose is simple plant-species recognition. Introducing identity context unrelated to the advertised function expands the trust boundary and may enable unintended account linkage or access to user-scoped data, especially when combined with the history-listing capability.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
This file implements a broad generic API wrapper with download URL generation, CRUD-style remote operations, arbitrary HTTP verbs, pagination helpers, and user lookup, which is substantially wider in scope than a plant-species recognition skill needs. In an agent-skill context, this expands the attack surface and can enable unintended remote actions or data access if other parts of the skill or prompt flow can influence the URLs, payloads, or invoked methods.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The get_user_by_username method exposes account/user lookup capability that has no clear connection to identifying plant species from images. In a skill environment, this can facilitate user enumeration or access to identity-related backend functions, especially if username input is attacker-controlled or if the surrounding system grants the skill broader privileges.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The add, edit, delete, and generic HTTP verb methods provide broad remote modification capabilities unrelated to the stated plant-identification purpose. Even without an obvious exploit in this file alone, these helpers make it easier for the skill to perform unauthorized state-changing operations against backend services if invoked by compromised logic or untrusted inputs.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The shared config layer for a plant-species skill reads unrelated identity and messaging environment variables such as sender open IDs and usernames. Even if not immediately exfiltrated here, collecting cross-context identity data expands the skill's privilege surface and can enable unintended user tracking, context leakage, or later misuse by other code paths.

Context-Inappropriate Capability

High
Confidence
87% confidence
Finding
This file exposes a very broad catalog of scene codes spanning surveillance, health, child, elderly, and other unrelated analysis domains far beyond plant recognition. In skill context, that kind of capability sprawl increases the chance of unauthorized feature enablement, misrouting requests to higher-risk analysis flows, and weakens assurance that the deployed skill is limited to its stated purpose.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements a generic persistent DAO and user-data layer, including database initialization, schema mutation, CRUD, and identity lookup, which is materially unrelated to image-based plant species recognition. Capability mismatch increases the attack surface and creates covert persistence for user/account data inside a skill that should not need long-lived identity storage.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores identity and secret-like fields including username, realname, email, token, and open_token. For a plant species recognition skill, collecting and persisting such data is unjustified and dangerous because it creates sensitive-data exposure, cross-context tracking, and credential leakage risk without an apparent functional need.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility module contains broad identity management, workspace inspection, token handling, and authenticated remote API access that is not justified by a plant-species recognition skill. The mismatch between declared purpose and implemented capabilities increases supply-chain risk because the skill can provision accounts, discover local workspace context, and communicate with external services under local identity without clear necessity or disclosure.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can silently register or create platform user accounts by posting openId/mobile/source values to a remote login endpoint when tokens are absent. For a plant identification skill, automatic account creation is unrelated to core functionality and can expose user identity, create unauthorized remote accounts, and establish persistent external linkage without meaningful user awareness.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code reads identity material from workspace files and local user databases to derive an open-id fallback, which exceeds the expected scope of plant-image recognition. Even if intended for convenience, this creates unnecessary access to local secrets and persisted identities, enabling silent reuse of internal credentials or user records for unrelated network operations.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The history-report trigger phrases are broad enough that ordinary user requests could unintentionally activate cloud history retrieval. In a skill that also auto-associates internal identity and fetches prior reports, overbroad triggering can cause unintended access or disclosure of account-linked historical data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that uploaded files or media are automatically saved locally, but this persistence is not surfaced as a clear user-consent event where the behavior is introduced. Automatic local storage of user-provided media increases privacy and retention risk, especially for images/videos that may contain incidental sensitive content or metadata.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The skill mandates direct cloud API access for history queries with no user choice or opt-in, despite involving identity-linked historical records. This is risky because it normalizes remote access to potentially sensitive account data as an automatic behavior rather than an explicitly authorized one.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2