Security audit

Plant Species test

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as plant recognition, but it also performs cloud account, identity, credential, history, and persistence operations with weak disclosure and scoping.

Review before installing. This skill sends media and identity-linked data to an external cloud service, silently creates or reuses backend/local user identity state, can query cloud report history, and stores tokens locally in plaintext. Install only if you trust the publisher and the lifeemergence.com service with those files, identifiers, report records, and account credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/util.py:567
Finding: Authentication credentials can be forwarded to arbitrary absolute URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:544
Finding: Plaintext upstream usernames are transmitted as identity and mobile fields
Content: View full analysis
`, which could associate reports without sending the upstream username. ### Attack Path 1. The host platform exposes a sender username through `OPENCLAW_SENDER_USERNAME`. 2. Configuration initialization stores the plaintext value in `CURRENT__USER_NAME`. 3. ...[truncated 656 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/dao.py:175
Finding: Reusable authentication tokens are stored in a plaintext SQLite database
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: skills/smyx_analysis/requirements.txt:3
Finding: Dependency manifest references an inconsistent YAML distribution name
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: HTTP requests to external services, token/auth handling, open-id generation, persistence, and workspace file operations are significant capabilities absent from the plant-recognition description. In context, that makes the skill more dangerous because users expect simple botanical analysis, not identity management and generic external-service integration.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "plant-species-recognition-analysis" description: "Accurately identifies plant species from images based on deep learning and computer vision, outputs structured information including species name, family, growth habits and maintenance tips. | 植物物种识别技能，基于深度学习与计算机视觉技术，通过图像快速识别植物物种，输出物种名称、科属分类、生长习性及养护要点等结构化信息，为园艺、生态调研、自然教育提供专业识别服务" version: "1.0.7" license: "MIT-0" --- # 🌿 Plant Species Recognition Skill | 植物物种识别技能 > **智能分析中枢** ·

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill that identifies plant species from images and returns botanical attributes like species, family, growth habits, and maintenance tips. In contrast, this code expects a local video path or network video URL, uploads it under videoUrl/file, and invokes a generic analysis flow with report polling/export behavior, which does not match the claimed plant-image recognition purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation clearly performs video analysis and history retrieval, while the manifest advertises plant species recognition from images. This kind of capability mismatch is dangerous because it can mislead users, reviewers, and policy enforcement into granting or invoking a skill under false assumptions, potentially exposing unrelated data flows or functionality that was not consented to.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file exposes a generic API wrapper with arbitrary URL-based GET/POST/PUT/DELETE plus CRUD helpers, which is far broader than the declared plant-species-recognition purpose. In a skill context, this creates a capability surface that could be reused to access or modify unrelated backend resources, especially if higher-level code can influence the target URLs or payloads.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The add, edit, and delete methods expose record mutation capabilities that do not align with a read-oriented image recognition skill. If reachable by the agent or downstream integrations, these methods could be abused to alter or remove backend data unrelated to plant analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements user/account database logic, including username lookup and default-user selection, which is unrelated to a plant-species recognition skill. The mismatch indicates unnecessary privileged functionality and data handling within the skill, expanding attack surface and creating opportunities for hidden persistence or identity-related abuse that users would not expect from the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The User model stores identity and authentication-adjacent fields including username, realname, email, token, and open_token, none of which are justified by a plant-recognition skill description. Retaining such sensitive data unnecessarily raises the risk of privacy violations, token leakage, account correlation, and misuse if the local database is accessed by other components or compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims plant-species recognition, but this utility implements user identity resolution, credential-file reads, default user generation, and persistence of identity state. That is dangerous because it expands the skill's privilege and data-handling scope far beyond image analysis, enabling undisclosed identity collection and backend account binding unrelated to the stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The HTTP helper performs external authentication, token loading/caching, automatic registration, retry-based reauthentication, and billing-specific flows, none of which are necessary for plant recognition. In this context, hidden auth and monetization logic increases the risk of silent data exfiltration, unauthorized account actions, and user confusion about what the skill is doing behind the scenes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The request path can automatically create or refresh backend user accounts as a side effect of ordinary HTTP operations. That is dangerous because a user invoking plant analysis may unknowingly trigger account creation, token issuance, and persistence, which materially changes the security and privacy posture of the skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no explicit tool scope even though its documented behavior clearly involves shell execution, network access, filesystem reads/writes, and environment usage. In an agent setting, missing scope declarations weaken least-privilege controls and can let the skill run with broader capabilities than users or the platform expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation expands the skill from plant recognition into cloud-based historical report querying and report-link output. This scope expansion matters because report retrieval can expose prior analysis metadata or artifacts beyond the immediate user request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Overly broad trigger phrases for history-report queries can cause the skill to invoke cloud retrieval when the user did not intend a records lookup. In this context, accidental history access is a privacy issue because it may expose prior report metadata or links.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2