Crop Pest Identification | 经济作物虫害识别

• Outcome: Review
• Latest audit: Aug 24, 2026 · 6:14 PM UTC
• Version: 1.0.9

Overview

The skill performs crop pest analysis, but it also silently manages identities, stores tokens locally, and retrieves cloud history, so it needs user review before installation.

Install only if you are comfortable with crop media or URLs being sent to the configured backend, a local workspace identity and SQLite database being created, and tokens/profile data being stored for later history queries. Review the backend endpoints and data retention policy first.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior includes shell execution, local file read/write, network access, and environment use. This mismatch reduces transparency and can cause the host agent to invoke capabilities users or reviewers did not knowingly approve, especially because uploaded media, local persistence, and backend calls are all in scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow pest identification, but the behavior reportedly also provisions accounts, creates persistent local identities, stores tokens and user metadata, and exposes historical report retrieval. That is a material expansion of trust and data handling beyond user expectations, creating risks of hidden state, credential misuse, privacy issues, and broader backend access than the declared function implies.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill exposes a `--list` mode that retrieves prior analysis records keyed by internal user identity, which exceeds the advertised pest-identification function. In the context of an image-analysis skill, hidden access to historical reports can enable unauthorized data disclosure or cross-user record access if identity handling is weak or spoofable.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The comment states identity is initialized without user input, but the code accepts a hidden `--open-id` value when provided. This mismatch can mislead reviewers and operators, and if downstream authorization trusts that identifier, an attacker may influence identity selection in ways not apparent from the user-facing interface.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The code explicitly processes and surfaces `commonAiResponse` and `healthAiResponse`, which are broader than the manifest’s stated crop-pest-identification purpose. This creates a scope-expansion/data-exposure risk: if backend responses contain unrelated or sensitive analysis content, the skill will forward it to the user without enforcing domain restrictions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill can enumerate prior analysis reports and generate export URLs even though this capability is not described in the manifest. Undocumented report listing/export functionality increases the chance of unauthorized access to historical results or metadata, especially because the commented-out `open_id` checks suggest missing access control enforcement.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The history-listing capability exposes prior analysis results based on an open_id-derived context, but this functionality is not clearly necessary for the declared pest-identification task. Unnecessary retention and retrieval features expand the attack surface and can leak prior user activity or submitted media metadata if access control around CURRENT__OPEN_ID or open_id resolution is weak elsewhere in the stack.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file exposes generic HTTP and CRUD wrappers (`add`, `edit`, `delete`, `http_post`, `http_put`, `http_get`, `http_delete`) that can be used to access or modify arbitrary backend resources, which is much broader than the stated pest-identification purpose. In a skill that is expected to process crop images and return pest classifications, these broad capabilities increase the attack surface and create a confused-deputy risk if other parts of the skill can pass user-influenced URLs or parameters into these methods.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The presence of resource-modifying helpers (`add`, `edit`, `delete`, and `http_put`) is not justified by an image/video pest detection skill, whose expected behavior is primarily read/process/return results. Even if these methods are not directly malicious, they enable state-changing operations against backend services and could be abused by adjacent code paths or future changes to perform unauthorized modifications unrelated to pest analysis.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module provides broad persistent database access and CRUD behavior that materially exceeds the stated purpose of crop pest identification from user-supplied media. Hidden general-purpose persistence increases the attack surface and creates an undocumented path for retaining user-linked data inside a skill that users would reasonably expect to perform transient image analysis only.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The User/UserDao definitions introduce account-like storage, including identifiers and profile fields, that are not disclosed in the pest-identification skill description. In context, this is more dangerous because an agriculture image-analysis skill has little legitimate need to retain user identities, making the collection appear unnecessary and privacy-invasive.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The model stores persistent profile attributes plus token and open_token values even though the declared skill function is crop pest identification. Retaining authentication-like secrets and user profile data without clear need or disclosure raises substantial privacy and credential-handling risk, especially if the local SQLite database is later accessed by other components in the shared workspace.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This utility layer creates or reuses persistent user identities outside the stated crop-pest-identification purpose, including generating default open IDs, reading identity material from workspace files, and storing user records locally. That creates undisclosed identity state and can cause requests to run under an implicit account, which is risky in an agent skill because it expands scope from image analysis into covert account lifecycle management.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The HTTP helper silently calls a phoneLogin/register flow to create or recover an account whenever tokens are absent, without a user prompt or task-specific need. In the context of a pest-identification skill, this is especially concerning because merely invoking utility networking may provision remote identities and bind activity to them behind the user's back.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: A default trigger that fires whenever a user provides crop-related media is overly broad for a skill that uploads content to a server-side API and may persist associated records. This can lead to unintended invocation on content shared for unrelated purposes, increasing accidental data disclosure and unexpected external processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description does not clearly warn that local files or supplied URLs will be transmitted to a server-side API for processing. That omission undermines informed consent and can expose sensitive local media, internal URLs, or private farm data to external services without clear user awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs hidden internal identity resolution with no user-facing warning, using a suppressed `--open-id` parameter and updating current identity state before handling requests. In combination with the report-listing feature, this increases the risk of silent data access under an unexpected or attacker-controlled identity.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: For local inputs, the skill reads the full file contents and uploads them to a backend analysis service without any visible consent, warning, or minimization controls in this code path. That can expose sensitive local media or embedded metadata to remote services, which is especially relevant because the skill accepts arbitrary local file paths.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function accepts a local file path or remote URL and forwards it to server-side analysis via skill.get_output_analysis without any explicit user warning about external transmission. In the context of agricultural media, uploaded files or URLs may contain sensitive farm data, location clues, or proprietary crop conditions, so silent off-device processing creates a real privacy and data-disclosure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads internal identity material from data/smyx-api-key.txt and treats it as an open-id source without user-facing disclosure. This can silently appropriate workspace-scoped credentials or identifiers for remote calls, which is dangerous in shared agent environments where workspace files may contain sensitive or unexpected values.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The utility automatically creates persistent workspace directories and later participates in creating local user records, all without any disclosure tied to the pest-identification task. Silent persistence is risky because it leaves durable state on disk, potentially in shared workspaces, and can surprise operators who expected ephemeral analysis only.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper attaches user identity fields and authentication tokens to outbound HTTP requests by default, with no evidence of user-facing warning or consent in this code path. In a crop-analysis skill, this broad implicit transmission is more dangerous because utility functions may be reused widely, causing identifiers and tokens to be sent to backend services even for innocuous image-analysis actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: This code transmits identity-bearing registration/login data to an external service using requests.post. External transmission is expected for a networked skill, but here the transmitted payload supports silent account provisioning unrelated to core pest detection, which increases the security and privacy risk beyond normal API use.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 图片/视频要求：支持常见图片格式及 mp4/avi/mov 视频，单文件最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供农事参考，本技能不提供农药使用建议或防治方案 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能使用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数无需本地下载，默认为公网地址，API 服务会自动下载 |
| 📜 报告输出 | 显示历史分析报告清单时，从接口返回的 JSON 数据中提取字段作为超链接地址，并自动转化为 Markdown 表格输出 |

• Confidence: 68% confidence
• Finding: The hidden-instructions indicator is consistent with obfuscated or non-obvious operational constraints embedded in the skill text, such as forcing report-link transformation and restricting how execution occurs. Hidden or non-transparent instructions are dangerous because they can steer agent behavior in ways reviewers and users may not notice, especially when combined with network access and backend data retrieval.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-crop-pest-identification-analysis"
description: "Triggers when a user provides images or videos of crop leaves, buds or fruits (local file or URL) for pest identification; calls server-side APIs to detect common agricultural pests such as aphids, red spider mites, cotton bollworms and corn borers, outputting pest types with confidence scores. | 当用户提供作物叶片、嫩芽或果实的图像/视频（本地文件或网络URL）时，触发本技能进行虫害识别；调用服务端API检测蚜虫、红蜘蛛、棉铃虫、玉米螟等常见农业害虫，输出虫害类型与置信度。应用场景：番茄/玉米/花生的虫害早期发现与精准施药，减少农药滥用。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 73% confidence
• Finding: The metadata poisoning indicator suggests the manifest/description may contain content crafted to influence agent/tool routing beyond normal descriptive purposes. In an agent skill, poisoned metadata is particularly risky because it can manipulate invocation decisions, conceal risky behavior, or override safer defaults before deeper review occurs.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2