Chinese Herbal Active Ingredient Trend Analysis | 中草药有效成分积累趋势评估

• Outcome: Review
• Latest audit: Oct 15, 2026 · 11:31 AM UTC
• Version: 1.0.13

Overview

This skill appears to be a cloud-backed herb image/video analyzer, but it also has under-disclosed account/token persistence and reused generic or pet-analysis components that should be reviewed before installation.

Install only if you are comfortable sending herb images/videos, submitted URLs, identity identifiers, and report-history queries to the configured lifeemergence.com services. Review the publisher and service terms first, and avoid using it with confidential farm imagery, internal-only URLs, or workspaces where local token storage in a SQLite database is unacceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims specialized herb-image analysis, but the observed behavior indicates generic remote API invocation, local identity handling, file/database access, and report retrieval unrelated to the stated purpose. This mismatch is dangerous because it can mislead users and orchestrators into providing sensitive images, files, URLs, or trust under false pretenses while the skill performs broader undisclosed operations.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit for metadata poisoning is consistent with a manifest that uses persuasive descriptive metadata while concealing materially different operational behavior and undeclared capabilities. In agent ecosystems, misleading metadata can influence routing, trust decisions, and automatic invocation, making downstream misuse more likely even without overt exploit code.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-chinese-herbal-ingredient-trend-analysis"
description: "AI-powered active-ingredient accumulation trend assessment for medicinal herbs (e.g. honeysuckle, wolfberry, astragalus, danshen). Uses high-resolution leaf images captured by fixed cameras or drones in TCM cultivation bases, analyzes leaf color saturation, hue angle, relative chlorophyll content (estimated via color indices) and leaf thickness (inferred from edge focus / silhouette), and compares against the cultivar's standard reference atlas (typical features at peak active-ingredient stage) to output an accumulation trend level (Low / Medium / High / Peak). Helps determine th

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The API documentation describes pet health analysis endpoints and scenario codes that do not match the skill’s declared purpose of Chinese herbal ingredient trend analysis. This kind of cross-domain mismatch can cause the agent or integrators to invoke the wrong backend, expose unrelated data exports, or route sensitive requests into an unintended service, making it a genuine security and integrity issue rather than a mere documentation typo.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill manifest promises herb leaf image analysis, but the implementation accepts arbitrary local files and remote video URLs for submission to the backend. This creates a dangerous capability mismatch: callers may believe they are providing constrained image inputs while the code actually enables broader data ingestion and external fetching, which can lead to unintended upload of sensitive content or abuse of backend URL-processing behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implementation materially deviates from the declared skill purpose: it accepts generic video input or remote video URLs, calls a generic analysis backend, and exposes a history-listing function unrelated to medicinal-herb leaf image trend assessment. This kind of skill/manifest mismatch is dangerous because users or orchestrators may grant permissions, route sensitive agricultural media, or trust outputs based on the declared herb-analysis purpose while the code actually performs broader media processing and data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The User model persistently stores token and open_token values alongside personal profile fields, yet the herb-analysis skill description provides no justification for handling credentials or identity data. Storing tokens in a local SQLite database materially increases the risk of credential theft, account compromise, and unauthorized cross-service access if the workspace or database file is exposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code performs automatic remote login/registration and token acquisition through a health endpoint, behavior that is materially outside the stated purpose of analyzing herb leaf images. It can create or bind accounts without an explicit user action, expanding the attack surface to account abuse, unauthorized network activity, and covert backend enrollment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and instructs use of shell execution, file handling, network access, and environment-dependent behavior, but does not declare any tool scope or permissions boundaries. This creates an undeclared capability surface where an agent may grant or assume broader access than users expect, increasing the risk of unauthorized file, shell, or network operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill omits a clear warning that uploaded files, URLs, and historical report queries may be sent to external APIs or cloud services. This is dangerous because users may unknowingly expose proprietary cultivation imagery, internal URLs, or report metadata to third parties without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger rules are broad enough to auto-activate on generic herbal or harvest-related discussion, especially when paired with file or URL inputs. Over-broad activation can cause unintended processing of user content, unnecessary cloud/API transmission, or invocation of sensitive capabilities without clear user intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest promises analysis of herbal leaf traits against cultivar reference atlases to output accumulation trend levels, but the code only forwards input to generic skill.get_output_analysis and skill.get_output_analysis_list while centering configuration around pet_type. Combined with the pet-oriented CLI surface, the actual behavior exposed by this file does not clearly match the declared herb-analysis functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argument parser description and help strings are written only in Chinese, and the runtime status/error messages are also Chinese-only. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script presents itself as a medicinal-herb active-ingredient trend assessor, yet it exposes a --pet-type option with cat/dog values and a --list help string for '宠物健康分析列表清单'. This is not merely incomplete documentation: the exposed interface and inline help actively contradict the stated purpose, indicating the code was repurposed from a pet-analysis skill without aligning intent documentation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2