Chinese Herbal Active Ingredient Trend Analysis | 中草药有效成分积累趋势评估

• Outcome: Review
• Latest audit: Aug 28, 2026 · 7:39 PM UTC
• Version: 1.0.10

Overview

This skill is not clearly malicious, but it mixes a herb-analysis purpose with account-linked cloud calls, local identity persistence, and unrelated pet/video remnants that need review before installation.

Install only after reviewing the cloud service, identity, and storage model. This skill can send herb images/videos or URLs to LifeEmergence-style backend services, silently create or reuse a local identity, store tokens in a workspace SQLite database, and fetch account-linked history reports; the pet/video leftovers and dev endpoint config should be fixed or explained before trusting it for production harvest decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 77% confidence
• Finding: Using getattr(self.__model__, key) on unvalidated filter keys allows a caller to select arbitrary model attributes for query construction. While this is not SQL injection because SQLAlchemy still parameterizes values, it can expose unintended columns, trigger exceptions for invalid keys, and weaken authorization/data-minimization boundaries if higher layers pass user-controlled filters.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 77% confidence
• Finding: The same unvalidated dynamic attribute access appears in count(), enabling arbitrary attribute selection for query predicates. In a shared generic DAO, this can support enumeration of sensitive records or application errors if upstream code forwards user-supplied filter names.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises a simple herb-image analysis workflow but, according to the detected capabilities, can access environment data, local files, network, and shell without declaring those permissions. This weakens user and platform visibility into what the skill can actually do and increases the risk of unexpected data access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is herb leaf trend analysis, but the behavior reportedly also includes remote account registration/login, local SQLite user data handling, reading an identity value from a workspace file, and report-list/export functions unrelated to the core task. That mismatch is dangerous because users may provide files or URLs for agronomy analysis while the skill silently performs identity and persistence operations outside their reasonable expectations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes a cloud historical-report lookup feature even though the manifest primarily presents it as image-based active-ingredient trend analysis. This creates unexpected data flows to remote services and broadens the attack and privacy surface beyond what a user would infer from the main description.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Automatic internal identity handling, silent reuse of a default local user, and auto-creation of user state are unrelated to straightforward herb-image analysis and introduce hidden identity persistence. This is risky because it can cause unauthorized account linkage, confusing cross-session data access, or leakage of another user's historical reports if identity state is reused improperly.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The file documents APIs for a pet health analysis service even though the skill is presented as a Chinese herbal ingredient trend analysis tool. This mismatch is dangerous because it strongly suggests the skill package contains unrelated or misplaced integration details, which can cause the agent to call the wrong backend, mishandle sensitive data, or expose capabilities outside the declared purpose. The contradiction increases risk because users and reviewers may trust the herbal-skill label while the actual referenced endpoints target a different domain.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The CLI presents this tool as a Chinese herbal active-ingredient trend analyzer, but the exposed behavior and labels still reference pet-analysis semantics and a pet health analysis list. This is a security-relevant integrity issue because operators may trust outputs, logs, or downstream automation as herb assessments when the underlying function appears to be wired to a different domain, creating a serious risk of unsafe harvesting decisions and misrouted data handling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The main analysis entrypoint delegates to a generic pet-type-based flow and mutates a pet-type default, rather than invoking a herb-specific active-ingredient trend assessment pipeline. In this skill context, that mismatch undermines functional integrity: users may receive plausibly formatted but semantically incorrect results for medicinal-harvest timing, which can directly affect agricultural and pharmaceutical decision-making.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially diverges from the manifest: it presents a generic video-analysis and history-listing client rather than herb leaf active-ingredient trend assessment. In security terms, this is dangerous because users and reviewers may grant the skill access, data, or operational trust based on the declared agricultural purpose while the code performs a different workflow and sends inputs to opaque backend logic.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The user-facing strings and CLI help describe a "video analysis tool," which contradicts the advertised herb leaf image trend-analysis function. This mismatch increases the risk of deceptive use, operator confusion, and accidental submission of unintended data to backend services under false assumptions about what the skill does.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file exposes generic CRUD and raw HTTP helper methods that accept caller-controlled URLs and payloads, which is materially broader than the declared herb-image trend-analysis purpose. In an agent/skill context, this expands the capability surface into arbitrary external API access and data operations, making misuse, data exfiltration, or unexpected side effects much easier if upstream inputs are influenced by users or other components.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The http_post/http_put/http_get/http_delete methods provide arbitrary remote resource access using caller-supplied URLs, effectively turning the skill into a general-purpose network client. In the context of a narrowly described agricultural image-analysis skill, this unnecessary capability can enable SSRF-like access patterns, unapproved outbound communications, or exfiltration of sensitive data through attacker-influenced requests.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file defines a full user/account persistence model and DAO with lookup and update behavior, which is materially unrelated to the manifest's herb-image trend analysis purpose. Such capability mismatch increases the risk of hidden data collection, unauthorized identity handling, or repurposing the skill to manage accounts outside user expectations.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The model stores identity attributes and authentication-like secrets such as token and open_token without any clear connection to plant-image analytics. Persisting such sensitive data in a local SQLite database creates confidentiality and misuse risks, especially when the skill's stated purpose gives users no reason to expect credential-like storage.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The DAO initialization creates and mutates a local SQLite database even though the manifest describes image-based agronomic analysis rather than local account/state management. This undisclosed persistent state expands the attack surface and can enable silent retention of user-related data or cross-run tracking.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This utility code performs automatic remote account login/registration, token acquisition, and token persistence, which is unrelated to herb-image trend analysis. It enables hidden authenticated communication with an external service and can create network-linked identities without explicit user awareness or consent, expanding both privacy and supply-chain risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code silently resolves or creates a default open-id, including reading from a local API-key file and persisting synthetic local user identities when none is supplied. That behavior is unrelated to the advertised image-analysis function and can establish durable identifiers that later support authenticated external activity without informed user action.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The workspace-detection logic inspects environment variables and filesystem layout to locate agent roots, skills, and data directories. For a herb-analysis skill this is unnecessary privileged context discovery and increases the blast radius for unintended access to other workspace data or credentials.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger is broad enough to activate on general herb-image analysis requests, which can cause the skill to run when the user did not clearly ask for it. Overbroad triggering is dangerous here because the skill also appears to save files and call remote services, so accidental activation can lead to unintended data handling.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The automatic history-report trigger relies on broad natural-language phrases that may overlap with routine requests, making it possible to invoke cloud report lookup unintentionally. Because report lookup is account- and network-related, unintended activation can expose metadata or retrieve sensitive historical results without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description does not clearly warn users that uploaded files and provided URLs may be transmitted to an API/cloud service for processing. This undermines informed consent and may lead users to disclose sensitive imagery, metadata, or internal URLs under the false assumption that analysis is local.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The function reads the full local file and sends it to a remote analysis service via `self.analysis(...)` without any user-facing disclosure, consent, or clear indication that local media leaves the host. In agricultural deployments, uploaded images or videos may contain sensitive operational data such as farm location, cultivation conditions, timestamps, or proprietary growing practices, creating privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code forwards a local file path or remote URL to backend analysis logic via `skill.get_output_analysis(...)` without any explicit disclosure, consent prompt, or clear indication that external processing may occur. In this skill context, cultivation-base imagery and URLs may contain sensitive operational data, so silent transmission creates privacy, confidentiality, and compliance risks.

Missing User Warnings

Low

• Confidence: 70% confidence
• Finding: The code silently creates and writes to a local SQLite database with no user-facing disclosure or consent mechanism. In isolation this is low severity, but it becomes more concerning here because the stored data includes user/account and token-related fields that are outside the skill's expected herb-analysis function.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2