Farmland Weed Identification | 农田杂草识别与密度评估

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.10

Overview

The skill is a cloud media-analysis tool, but it silently creates or reuses an identity, stores authentication tokens locally, and is configured to use development HTTP endpoints, so it should be reviewed before installation.

Install only if you are comfortable with this skill sending field images or videos and identity-linked requests to the provider's backend, creating/reusing a local identity, and keeping tokens in a workspace SQLite database. Ask the publisher to switch from dev HTTP endpoints to production HTTPS endpoints, document retention and token handling, and require clearer confirmation before history lookups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill manifest advertises no explicit permissions while the documented behavior invokes local scripts, reads and writes files, uses network access, and requires shell execution. This creates a transparency and governance gap: operators may approve or route the skill as low-risk while it can actually access local media, persist data, and contact backend services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is narrow agricultural image analysis, but the skill also performs backend report listing, identity resolution, auto-registration/login, token retrieval, and local SQLite persistence. That mismatch is dangerous because users and reviewers may trust it as a simple classifier while it actually handles identity, historical data access, and persistence, increasing privacy and abuse risk beyond the stated scope.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill is presented as farmland weed identification, but the exposed --pet-type parameter and mutation of ConstantEnum.DEFAULT__PET_TYPE indicate code reuse from an unrelated pet-analysis workflow. This kind of capability/metadata mismatch is dangerous because it can route data into the wrong backend logic, produce misleading agronomic outputs, and hide unexpected behaviors from users and reviewers.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The implementation supports video input and history listing features that are not disclosed in the manifest, expanding the skill's actual behavior beyond what users expect. Hidden capabilities increase security risk because they broaden attack surface, may trigger collection or retrieval of prior analysis data, and undermine informed consent and reviewability.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially conflicts with the declared skill purpose: it operates as a video-analysis and history-listing CLI rather than a weed-identification tool for field images and heatmap generation. This kind of capability mismatch is dangerous because it can cause the platform or user to invoke unintended functionality, including processing arbitrary local paths or remote URLs and exposing unrelated backend behavior under a misleading agricultural label.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The docstrings, argparse description, arguments, and user-facing messages repeatedly present the tool as 'video analysis,' directly contradicting the advertised weed-image analysis function. This deception-by-mismatch increases the risk of unsafe integration decisions, incorrect trust assumptions, and accidental data exposure because operators may provide sensitive inputs to a tool whose real behavior is different from what the catalog claims.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This service exposes generic HTTP verbs and CRUD-style helpers that can send requests to arbitrary URLs, which is broader than the skill’s stated purpose of weed-image analysis and heatmap generation. In an agent setting, these wrappers can be repurposed to interact with unrelated internal or external services, increasing the risk of unintended data exfiltration, unauthorized modifications, or use as a general network proxy.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The presence of generic edit, delete, PUT, and DELETE request helpers gives the skill remote resource modification capabilities that are not justified by its declared analytical function. If reachable by higher-level skill logic or prompt-controlled inputs, these methods could be abused to alter or delete data in connected systems well beyond weed-analysis outputs.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module provides persistent user/account database creation and mutation logic that is unrelated to the stated weed-identification purpose of the skill. In an agent setting, unexplained identity and account-state management materially expands the skill's authority and data-handling surface, enabling collection or modification of local user records beyond what users would reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User schema stores identity fields and authentication material such as token and open_token, which are highly sensitive and unrelated to farmland image analysis. If this skill is invoked in a broader agent environment, compromise or misuse of this module could expose credentials or allow unauthorized linkage between users and agent actions.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The file advertises a generic lightweight database wrapper, but it also performs hard-coded sys_user schema migration and includes user DAO behavior. That mismatch reduces transparency and can conceal sensitive data handling, making security review, least-privilege scoping, and user consent significantly harder in an unrelated agricultural analysis skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility code performs remote account login/registration and persists tokens through _get_or_create_user() and http_request(), behavior unrelated to weed identification. This silently creates or reuses identities, contacts external services, and stores authentication material, which expands the trust boundary and can leak or misuse workspace/user identity without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads identity from workspace files and, if absent, creates a default local user identity and stores/reuses it. For an image-analysis skill, this identity bootstrap is not justified by function and can cause silent cross-session attribution, privacy issues, and unintended linkage of actions to a fabricated or reused account.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The historical report trigger phrases are broad enough to match ordinary conversation, causing automatic cloud report retrieval when a user may only be discussing past analyses in general terms. In a skill that accesses historical records tied to an internally resolved identity, over-broad triggering can lead to unintended data disclosure or unnecessary backend access.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill states that uploaded images or videos are automatically saved as local files, but it does not clearly warn the user about retention, location, lifecycle, or access controls. Automatic local persistence of user-provided media expands the attack surface for data leakage, especially when combined with other file and identity capabilities.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill reads arbitrary local file contents and sends them to a remote analysis service via `self.analysis(...)` without any user-visible confirmation, prompt, or narrowing to the documented weed-image use case. In an agent setting, this increases the risk of unintended sensitive file disclosure if an attacker can influence `input_path` or if users misunderstand that local contents will be uploaded off-host.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The HTTP helper automatically attaches and transmits identity and authentication data such as pnaUserName, X-Access-Token, X-Api-Key, and Authorization headers, while also potentially registering the user upstream. In a shared utility used by a weed-analysis skill, this is dangerous because network transmission of sensitive identifiers happens implicitly, without any visible user-facing disclosure or opt-in in this code path.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: This call posts openId/mobile/source data to an external health/login endpoint as part of automatic user provisioning. External transmission of identity data is sensitive on its own, and it is especially suspicious here because it is embedded in generic utility code for a skill whose stated purpose is plant/weed image analysis.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-farmland-weed-identification-analysis"
description: "Identifies weed species and coverage density from field top-view images, and outputs a weed distribution heatmap dataset to support precision weeding decisions. | 通过田间图像识别杂草种类与覆盖密度，生成除草建议区域热力图。"
version: "1.0.8"
license: "MIT-0"
---

• Confidence: 67% confidence
• Finding: The metadata shows poisoning indicators because the manifest description and surrounding content mix declarative metadata with behavior-shaping instructions and suspicious hidden-character signals. In agent ecosystems, polluted metadata can mislead tool selection, policy evaluation, or downstream orchestration, especially when the skill already understates its real capabilities.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2