ClawHub
Back to skill

Security audit

Crop-Specific Disease Database | 经济作物专属病害库

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform crop disease analysis, but it also silently manages account identity/tokens and has a risky Python import setup, so users should review it before installing.

Install only if you trust the publisher and the lifeemergence.com service with uploaded crop media, report history, and account-linked tokens. Run it from a protected workspace, avoid shared writable install paths, and review or remove the silent identity/token persistence before using it in sensitive environments.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/smyx_crop_specific_disease_analysis.py:2
Finding

Shared Temporary Directory Precedence Enables Python Import Hijacking

Content
View full analysis

Vulnerability Details

File Location: scripts/smyx_crop_specific_disease_analysis.py, lines 2–20
Vulnerability Type: Python module search-path hijacking
Risk Level: High

Vulnerable Code

python
import sys
import os

current_dir = os.path.dirname(os.path.abspath(__file__))
parent_dir = os.path.dirname(os.path.dirname(os.path.dirname(current_dir)))
sys.path.insert(0, parent_dir)

import argparse
import json
import mimetypes
import traceback
from datetime import datetime

import requests
import sys
import os

from .config import *

from .skill import skill

from skills.smyx_common.scripts.util import RequestUtil, OpenIdUtil

Technical Analysis

The entry point calculates a directory three levels above scripts/smyx_crop_specific_disease_analysis.py and inserts it at the beginning of sys.path.

In the audited installation layout, the entry point is located at:

text
/tmp/clawhub-codex-scan-v57c67drb9prnrz2q1cfgtp4s58g8afa-TIpVpc/artifact/scripts/smyx_crop_specific_disease_analysis.py

The three parent traversals resolve as follows:

  1. .../artifact/scripts → .../artifact
  2. .../artifact → .../clawhub-codex-scan-v57c67drb9prnrz2q1cfgtp4s58g8afa-TIpVpc
  3. .../clawhub-codex-scan-v57c67drb9prnrz2q1cfgtp4s58g8afa-TIpVpc → /tmp

Consequently, /tmp is placed at index zero of Python’s module search path. The entry point subsequently performs absolute imports from the skills package:

python
from skills.smyx_common.scripts.util import RequestUtil, OpenIdUtil

A separate local user who can create /tmp/skills can therefore provide a counterfeit skills package. Python may resolve the absolute import from that shared temporary location before reaching the legitimate project package. Module-level code in the counterfeit package executes immediately during import with the privileges of the user or Agent invoking the Skill.

This is an exploitable coding defect; the reviewed evidence does not establish that the ...[truncated 1860 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the sys.path modification. Package and install the project normally, then rely on package-relative imports.

  2. Use relative imports for project-owned modules where appropriate, rather than resolving the top-level skills package through a dynamically modified search path.

  3. If path initialization is unavoidable, derive the canonical project root precisely. For example, resolve the directory that actually contains the trusted skills package rather than traversing a fixed number of parents:

    python
    from pathlib import Path

project_root = Path(__file__).resolve().parents[1]

  4. Do not add shared writable directories such as /tmp to sys.path, especially not at index zero.

  5. Validate the resolved import root before modifying the search path:

    • Canonicalize it with Path.resolve().
    • Confirm that the expected project marker files and package directories exist.
    • Reject roots that are shared temporary directories.
    • Verify that the path is owned by and not writable by unauthorized users.

  6. Run the Skill from a protected installation directory with permissions preventing modification by unrelated local users.

  7. Add a regression test that imports the entry point from representative installation paths and asserts that:

    python
    skills.smyx_common.scripts.util.__file__

    resolves beneath the trusted project or installed package directory, never beneath /tmp or another shared writable location.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (55)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The combination of network communication, auth token handling, identity creation/login, local workspace access, and generic utilities far exceeds the apparent scope of crop image diagnosis. In context, this makes the skill more dangerous because users would reasonably expect a narrow classifier, not an account-aware remote client with local data access.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

The metadata poisoning indicator suggests the manifest may contain suspicious or malformed descriptive content intended to influence tool selection or review heuristics. Even if not overtly malicious here, poisoned metadata in a skill manifest is risky because it can mislead orchestration logic and hide the skill's real capabilities.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "smyx-crop-specific-disease-analysis"
description: "Expands the disease identification library to cover economic-crop-specific diseases (corn northern/southern leaf blight, potato late blight, peanut leaf spot, tomato viral disease, etc.) for precise leaf-disease recognition. | 扩充病害识别库至经济作物专属病害（玉米大斑病/小斑病、土豆晚疫病、花生叶斑病、番茄病毒病等），实现叶片病害的精准识别。"
version: "1.0.15"
license: "MIT-0"
---

# 🌽 Crop Specific Disease Identification | 经济作物专属病害库

> 扩充病害识别库至经济作物专属病害（玉米大斑�

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation materially contradicts the advertised skill purpose: instead of crop-specific leaf-disease recognition, it exposes a generic video-analysis and history-listing workflow. This kind of skill/behavior mismatch is dangerous because users may grant access or provide inputs under false assumptions, while the code performs unrelated remote analysis and can access historical analysis data via hidden/internal parameters.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The User model persists token and open_token values even though the skill is described as crop-disease analysis. Storing authentication-like secrets without a clear need creates unnecessary exposure: local compromise, logs, backups, or unintended DAO access could disclose tokens and enable account takeover or cross-service misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill reads a workspace credential file, searches a local database for reusable identities, and creates/persists default user identities when none exist. For a crop-disease analysis skill, silently provisioning and reusing identities is unjustified and dangerous because it creates durable account state and can cause actions or API usage to be attributed to a user identity without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code implements a generic authenticated HTTP client, token handling, retry logic, account bootstrap, and response processing that are far beyond the declared purpose of crop disease recognition. Such functionality enables outbound communications and authenticated actions to remote services, making data exfiltration or unauthorized account activity possible if the skill is invoked in sensitive environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permissions while its documented behavior requires shell execution, file handling, environment access, and network communication. This creates an over-privileged and opaque execution model where the host may grant broader capabilities than users or reviewers expect, increasing the risk of misuse or data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The history-report trigger phrases are broad enough that ordinary user language could invoke cloud report retrieval unintentionally. Because the feature is tied to internal identity and remote APIs, accidental activation could expose account-linked report metadata or cause unexpected backend access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code returns a fixed Chinese-language heading string for output analysis content. Because the skill does not offer user opt-in for language selection or indicate that it is intentionally limited to a Chinese-speaking context, it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a skill for economic-crop-specific leaf disease recognition, but the implementation accepts a pet_type argument and mutates ConstantEnum.DEFAULT__PET_TYPE based on values like cat/dog/other. Pet classification is not an obvious implementation detail for crop disease analysis and indicates the code behavior is inherited from a different domain than the declared purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The user-facing documentation says the tool analyzes crop leaf images/videos, but the --pet-type option explicitly offers cat, dog, and other, with help text framing the argument as a category marker. This is an active contradiction between the skill's documented purpose and the code's own interface documentation, not merely an omission.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Multiple user-facing strings are hard-coded in Chinese, indicating the skill presents output in a fixed language without offering the user a language choice. That can violate language/locale policy when no opt-in or justification for a Chinese-only experience is documented in the file.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2