Back to skill

Security audit

Leaf Aging Fall Prediction | 植物叶片老化/脱落预测

Security checks across malware telemetry and agentic risk

Overview

The skill can analyze plant media as described, but it also silently creates or reuses an identity, contacts a remote login service, and stores session tokens locally without clear user control.

Install only if you are comfortable with this skill sending plant image or video content, remote URLs, identity metadata, and report-history requests to lifeemergence.com services. Treat it as an account-linked cloud skill, not a local-only plant analyzer, and review or clear its workspace data database if you do not want persisted tokens or reused history context.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises no explicit permissions, yet the manifest directs execution paths that imply shell execution, network access, local file read/write, and environment use. This is dangerous because operators and downstream systems may trust the skill as low-risk while it can persist files locally and communicate with remote services, expanding attack surface without transparent capability declaration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The manifest claims a narrow plant-aging analysis function, but the documented behavior includes account initialization, local identity persistence, backend historical report access, and generic media handling. This mismatch is dangerous because it hides sensitive identity and data-management behavior behind an innocuous gardening use case, undermining informed consent and making abuse or unexpected data exposure more likely.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill claims to analyze fixed-camera daily houseplant leaf imagery, but the implementation accepts arbitrary local files and arbitrary remote video URLs and forwards them to the analysis backend. This scope expansion increases the chance of unintended data exfiltration, misuse for unrelated media analysis, and privacy exposure because the code does not constrain inputs to the manifest-described use case.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially diverges from the manifest: it is a generic video-analysis/history CLI rather than a leaf-aging prediction tool operating on fixed daily plant imagery. This mismatch is dangerous because users and orchestration systems may grant the skill permissions, data access, or trust based on the declared plant-health purpose while the code actually processes arbitrary local files or remote URLs through another backend, creating a deceptive capability surface and increasing the risk of unintended data exfiltration or misuse.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The docstrings and CLI help repeatedly describe 'video analysis' and history listing, contradicting the manifest's stated leaf-aging image analysis purpose. While this is partly a documentation issue, in security terms it reinforces the capability mismatch and can mislead reviewers, users, or automated agents into invoking broader processing than intended, especially where hidden/internal parameters and backend analysis calls already exist.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file exposes a generic API wrapper for add/edit/delete/list and raw HTTP verbs that are not narrowly scoped to the declared leaf-aging analysis purpose. In an agent-skill context, such reusable network primitives can enable capability expansion, data exfiltration, or unauthorized remote interaction if other parts of the skill can supply endpoints or payloads, making the implementation broader and riskier than the manifest suggests.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The http_post/http_put/http_get/http_delete methods accept caller-supplied URLs and arbitrary arguments, creating an unrestricted outbound HTTP capability. In a skill whose stated purpose is local plant monitoring and prediction, this is unjustified and dangerous because it can be abused for SSRF-like access, covert data exfiltration, or interaction with unintended external services if an attacker influences inputs or downstream call sites.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements broad shared DAO functionality and mutable user-database management that is not necessary for a houseplant leaf-aging prediction skill. Excess capability increases attack surface and enables collection or modification of unrelated local state, especially when combined with generic CRUD methods and shared workspace database handling.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The User model stores identity and credential-like fields such as username, email, token, and open_token, which are unrelated to the declared plant-monitoring purpose. Unnecessary handling of tokens and personal identifiers materially raises privacy and secret-exposure risk, and the generic DAO methods can update and persist these values without clear purpose limitation.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs broad outbound API access, token injection, automatic identity resolution, and account lifecycle handling that are unrelated to the declared purpose of leaf-aging image analysis. This creates an undisclosed external communications and credential-handling surface, making the skill capable of transmitting user/workspace context and interacting with remote services beyond user expectations.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can silently call an external /sys/phoneLogin endpoint with register=1 and user-derived identifiers, meaning it may create or log into remote accounts without clear user action. For a plant leaf prediction skill, this is functionally unnecessary and expands privacy, billing, and account-abuse risk if triggered automatically.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code inspects workspace layout, environment variables, local data files, and shared identity state to determine or create a current open-id across agent contexts. That exceeds the declared image-analysis scope and introduces cross-context identity persistence and unintended data coupling between agents or workspaces.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The default trigger language is broad enough that many ordinary plant image or video requests could automatically invoke this skill. Overbroad activation is dangerous because it can cause unintended file handling, cloud requests, or backend-linked processing without the user's clear intent to use this specific workflow.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The keyword trigger list includes common problem phrases like yellow leaves or leaf drop without enough contextual constraints. This is dangerous because benign gardening discussions may trigger automated processing, including file saving or cloud queries, beyond what the user expected.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that uploaded attachments or media files will be automatically saved locally, but does not warn the user about retention, path, duration, or access controls. Automatic undisclosed storage is dangerous because sensitive user media may persist on disk unexpectedly and become accessible to other processes or future sessions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill requires direct cloud API access for historical reports yet does not clearly inform the user that data retrieval and possibly linked account context will be handled remotely. This is dangerous because users may unknowingly trigger remote access to personal or account-scoped report data without informed consent or visibility into which backend account is being used.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The skill mandates hidden internal identity handling, including automatic reuse or creation of a local default user, while forbidding disclosure of which identity context is used. This is dangerous because it removes user control over account selection and can cause cross-user confusion, unauthorized data association, or silent access to another local profile's history.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code uploads either full file contents or a remote video URL to an analysis service without any user-facing notice, consent prompt, or minimization in this component. For a home camera/plant-monitoring context, media may contain sensitive household imagery or location-bearing URLs, making silent transmission a meaningful privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The helper exposes silent file opening in write mode and directory creation without any confirmation, which can overwrite files or create state unexpectedly when called by higher-level code. While not inherently malicious, it reduces transparency and can enable unintended local modifications if paired with user-controlled paths.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The utility automatically creates agent data and skills directories as a side effect of path resolution, without explicit disclosure. In an agent environment this silently alters local state and may facilitate persistence or installation behavior that users would not expect from a leaf-aging analysis skill.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code automatically sends network login or registration requests without clear disclosure or a dedicated consent boundary. Even if intended to streamline setup, hidden authentication traffic is risky because it can create remote identities, expose metadata, and trigger usage on external services unexpectedly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The HTTP wrapper automatically attaches account identifiers, tenant data, skill platform metadata, and tokens to outbound requests, which can leak more context than necessary to remote services. Because this occurs in a generic helper, many callers may transmit sensitive context implicitly without realizing it.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2