Back to skill

Security audit

Flowering Date Prediction | 开花植物花期预测

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform the advertised flowering analysis, but it also silently creates or reuses local identity state and uses token-bearing cloud requests with weak user-facing control.

Review before installing. Only use this skill if you are comfortable with greenhouse images or URLs being sent to LifeEmergence services, report history being queried from the cloud, and the skill creating/reusing local identity records and storing returned tokens in a workspace database. Avoid using it with sensitive facility footage or credentials until the publisher narrows and documents identity, token storage, retention, and endpoint scope.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises no explicit permissions, yet its documented behavior includes shell execution, file reads/writes, network access, and environment usage. This mismatch reduces transparency and can cause an agent or reviewer to authorize a skill without understanding that it can store files locally, invoke scripts, and send data to remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow flowering-date prediction, but the described behavior expands into backend history retrieval, local identity creation/storage, and generic AI analysis unrelated to the stated function. This kind of scope mismatch is dangerous because users and orchestrators may grant trust or data based on an agricultural prediction use case while the skill performs broader persistence and remote data operations behind the scenes.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill introduces automatic internal identity handling, fallback to a local default user, and possible local user creation/storage even though this is unrelated to image-based flowering prediction. Hidden identity persistence increases privacy and cross-session tracking risk, and can silently associate user actions with stored local identifiers.

Context-Inappropriate Capability

Low
Confidence
79% confidence
Finding
The skill mandates cloud retrieval of historical reports, which is outside the narrow prediction-focused purpose described in the manifest. While not inherently malicious, this broadens data access and introduces additional remote data exposure and account-linked behavior beyond what a user may expect from a one-off prediction tool.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The API documentation describes pet health analysis endpoints even though the skill is marketed as flowering-date prediction. This mismatch strongly suggests the skill package contains unrelated or recycled components, which can mislead integrators into calling the wrong backend, handling the wrong data types, or exposing data flows that were never intended for this skill. In a security review, such cross-domain inconsistency is dangerous because it can hide shadow functionality or indicate poor supply-chain hygiene.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The documented API behaviors—starting health analysis, retrieving health results, listing reports, and exporting report details—are unrelated to flowering phenology prediction. If these references are real, the skill may invoke or expose unintended APIs, creating a risk of unauthorized data access, privacy issues, or accidental use of a different service under the guise of agricultural analysis. The domain mismatch makes the skill context more suspicious, not less, because plant imaging should not normally depend on pet health report endpoints.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The script’s implementation and argument schema do not match the advertised flowering-date prediction purpose: it reuses pet-oriented parameters and list/help behavior, creating a strong risk that the wrong backend, model, or data-handling path is invoked. In a security-sensitive agent ecosystem, this kind of skill/implementation mismatch can cause unintended data collection, misrouting of user inputs, and unsafe operator trust in a tool that is not doing what it claims.

Intent-Code Divergence

High
Confidence
90% confidence
Finding
Contradictory comments and CLI help text describing pet analysis instead of flowering prediction can mislead users and reviewers about what data is being processed and what service is actually being called. This increases the chance of unsafe usage, accidental disclosure of unrelated data, and failure to detect that the skill is a mislabeled wrapper.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This file exposes broad generic network capabilities including CRUD-style wrappers and arbitrary GET/POST/PUT/DELETE methods that can target caller-supplied URLs. That exceeds the declared flowering-date prediction purpose and creates a confused-deputy risk: other parts of the skill or upstream inputs could use this service to access or modify unrelated remote resources.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The add, edit, and delete methods support remote resource modification, but the skill is described as an analysis/prediction capability rather than a system that should change external state. In context, these write-capable methods enlarge the attack surface and could be abused to alter backend data or trigger unintended actions if exposed through the agent.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
A flowering-date prediction skill should not need generic user-account persistence with username lookup and default-user selection. This scope mismatch increases suspicion because it introduces identity handling capabilities unrelated to the declared agricultural function, expanding the attack surface and data-collection footprint.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The User model stores sensitive identity and authentication-related fields such as username, realname, email, token, and open_token, which are unrelated to bloom-date prediction. In this skill context, collecting and persisting such data is especially risky because it enables unnecessary credential/token retention and potential privacy harm if the local SQLite database is exposed.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code creates, resolves, and persists user identities unrelated to flowering-date prediction, including reading an identity from a local file and generating/storing default users in a database. That is dangerous because it silently establishes durable identity state and can cause unauthorized account linkage or hidden backend usage outside the skill's declared purpose.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The request wrapper performs generic authenticated HTTP operations, auto-recovers tokens, provisions users through a login endpoint, and attaches authentication headers to outbound requests. For a greenhouse phenology skill, this is overbroad hidden network capability that could be repurposed to transmit data, act on behalf of users, or access unrelated backend services.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code inspects environment variables, runtime file paths, and workspace layout to locate agent-specific directories. In isolation this is not always malicious, but in this skill context it exceeds the stated agricultural prediction function and increases the ability to discover local filesystem structure for persistence, data collection, or lateral interaction with other agent workspaces.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-query trigger phrases are broad enough that ordinary requests about reports or history could invoke cloud retrieval unintentionally. Over-broad triggers can cause the skill to access backend data in contexts the user did not clearly intend, increasing the chance of unnecessary data exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation says uploaded attachments and media are automatically saved as local files without clearly warning the user. Silent local persistence of user-provided images or videos creates avoidable privacy and retention risk, especially for data captured from private greenhouses or commercial operations.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill states that network URLs are sent to an API service which will automatically download the resource, but it does not give a clear privacy or data-transfer warning. This can expose user-supplied URLs and linked content to third-party services without informed consent and may also enable unintended fetching of sensitive resources if input validation is weak.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs cloud API queries for historical reports but does not clearly tell users that their report metadata and access requests are handled by a remote service. This creates an informed-consent gap and may expose account-linked historical data unexpectedly.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code reads an arbitrary local file into memory and sends it to a downstream analysis service without any visible consent prompt, disclosure, redaction step, or destination transparency in this file. In environments where users may supply sensitive greenhouse, drone, or facility footage, this can lead to unintended exfiltration of proprietary or personal data to a remote service.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill reads a sensitive identity value from data/smyx-api-key.txt without any visible user disclosure, consent, or validation of what that value represents. This is risky because local secrets or identifiers can be silently repurposed for authentication and network actions beyond the user's expectations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The HTTP layer injects pnaUserName and authentication material such as X-Access-Token, X-Api-Key, and Authorization into outbound requests without any user-facing disclosure in this code path. This creates hidden sensitive-data transmission, which is especially concerning because the declared skill purpose does not imply remote account operations or token-bearing API calls.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2