ClawHub
Back to skill

Security audit

Crop-Specific Disease Database | 经济作物专属病害库

Security checks across malware telemetry and agentic risk

Overview

This crop-disease skill is mostly coherent, but it silently creates or reuses an identity, stores authentication tokens locally, and sends files/history requests to remote services with under-disclosed scope.

Review before installing. Use it only if you are comfortable with crop images or videos and history queries being sent to a remote service, and with the skill creating or reusing a local identity and storing service tokens in the workspace data directory. The publisher should clarify production endpoints, retention, account creation, and token handling before broad use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
The filter key is taken from the caller and passed into getattr(self.__model__, key) without validation. While this is not classic SQL injection because SQLAlchemy still builds the query safely, it can let untrusted callers probe model internals, trigger unexpected exceptions, or query on fields that should not be exposed, which becomes more concerning in a generic shared DAO reused across skills.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
This repeats the same unvalidated dynamic field selection in the count() method. If filter keys are influenced by external input, callers may access unintended model attributes or cause denial-of-service-style exceptions, especially because this DAO is generic and may be used with sensitive user models.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read local files, write files, use shell commands, access environment-backed identity state, and contact a remote API, yet no explicit permissions are declared. This creates a capability/consent mismatch: users and the hosting platform may not realize the skill can exfiltrate uploaded content or query cloud data using hidden identity context.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation contradicts the stated crop leaf-disease purpose: it accepts arbitrary local files or remote URLs and submits them to a generic analysis/report workflow using video-oriented parameters such as 'videoUrl'. This kind of scope mismatch is dangerous because users may trust the skill as a narrow plant-disease tool while it actually acts as a broader file/URL uploader, increasing the risk of unintended data exfiltration or misuse of unrelated content.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially contradicts the declared skill purpose: it performs generic video analysis and exposes video-history listing rather than crop-specific leaf-disease recognition. This is dangerous because users may provide agricultural imagery or trust the skill for a narrowly scoped purpose while their data is instead routed into an unrelated analysis workflow, creating deception, privacy, and supply-chain trust risks.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The user-facing strings, argument descriptions, and tool help all present this as a video analysis utility, which directly conflicts with the metadata claiming crop-disease recognition. Such misrepresentation increases the likelihood of user confusion and inadvertent disclosure of data to an unexpected processing pipeline, and it is a strong indicator that the packaged skill is not what it claims to be.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file exposes broad-purpose HTTP and CRUD wrappers, including arbitrary GET/POST/PUT/DELETE operations against caller-supplied URLs, which materially exceeds the stated crop-disease-analysis purpose. In an agent skill context, this creates unnecessary remote action capability that could be repurposed for unintended data access, exfiltration, or modification if higher-level controls are weak or bypassed.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The add, edit, and delete methods provide direct remote modification capability without any visible restriction to disease-recognition functions or specific backend resources. For a skill whose declared purpose is leaf-disease recognition, these mutation primitives are unjustified and expand the attack surface by enabling unauthorized changes or destructive actions if invoked by an agent or abused through prompt-driven tool use.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is described as crop-disease recognition, but this file implements generic user-account persistence and lookup functionality. That scope mismatch increases attack surface and creates unnecessary handling of identity-related data in a skill that should not need it, which is risky if the surrounding platform grants the skill DB access by default.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The model stores token and open_token fields even though the skill is presented as disease analysis only. Retaining authentication-related secrets in a local SQLite database broadens the consequences of compromise, enables credential leakage, and is especially unjustified in this context because the declared functionality does not require account-token persistence.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This code creates and mutates a general-purpose local database, including schema changes and broad save/update behavior, which exceeds what a crop-disease recognition skill would ordinarily need. In context, the unnecessary persistence layer increases the blast radius for misuse, data retention issues, and hidden cross-feature data collection.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code inspects workspace environment state and locates agent data/skills directories, which is unrelated to crop disease recognition. That increases the skill's access to local execution context and enables discovery of files and identity material that can later be consumed by other routines in this module.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The module creates synthetic user identities, persists them locally, and reuses them automatically. For a crop disease analysis skill, silent account creation and identity persistence are unnecessary and materially expand the skill's ability to impersonate users, accumulate tokens, and establish durable remote accounts without informed consent.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The advertised purpose is plant disease recognition, yet this helper performs remote login/registration, token retrieval, token caching, authenticated API calls, and retry logic. That mismatch makes the behavior risky because users invoking a disease-analysis skill would not reasonably expect it to establish accounts or transmit identity and authentication data to external services.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-report trigger phrases are broad enough that ordinary requests like 'show reports' or 'history report' could automatically invoke a cloud query without a clear confirmation step. That can cause unintended access to potentially sensitive prior analysis records tied to the internal identity context.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The workflow states that attachments are saved locally and that analysis/report listing is performed through a server-side API, but the user-facing description does not prominently warn that uploaded files and report queries are transmitted to a cloud service. This weakens informed consent and increases the risk of privacy surprises or unauthorized external sharing of user-provided data.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code initializes internal identity context through a hidden parameter and current-user resolution without clear user disclosure. In a skill context, silently binding analysis activity to an internal user identity can expose historical reports, attribute actions to the wrong principal, or cause privacy violations if identity is inferred from ambient context.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code reads the full contents of a local file and forwards it to an external analysis API, but this file contains no user-facing warning, confirmation, or minimization controls. In a skill presented as disease recognition, silent upload behavior is risky because users may provide sensitive local files under the mistaken belief that processing is narrowly local or limited to plant imagery.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The hidden --api-key argument and network-oriented parameters enable credentialed remote processing without clear user disclosure in help output. In a skill that is already misrepresented, concealed credential and transmission paths are especially risky because they can facilitate silent exfiltration of user data to external services under the guise of a local or domain-specific tool.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code reads a local identity value from data/smyx-api-key.txt and treats it as an internal open-id without any visible notice or consent. Silent harvesting of workspace identity data is dangerous because it can bind skill activity to a user or account unexpectedly and feed subsequent remote authentication flows.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The _get_or_create_user routine sends openId, mobile, and source fields to a remote login/registration endpoint automatically. This is dangerous because it transmits identity-linked data off-host and may create or access accounts without the user understanding that a plant-disease skill is performing enrollment or login operations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The generic HTTP helper automatically attaches app identifiers, tokens, open tokens, usernames, tenant and platform metadata, then sends arbitrary request data to remote services. In the context of a disease-recognition skill, this broad transmission capability creates unnecessary privacy and credential-exposure risk, especially because the user-facing purpose does not disclose such behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
This line performs an external POST to a health-domain login endpoint with structured identity data. External transmission itself is not always unsafe, but here it is mismatched with the skill's stated agricultural purpose and occurs as part of hidden account provisioning, making it a real privacy and trust-boundary issue.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2