Back to skill

Security audit

Leaf Curling & Margin Scorch Diagnosis | 植物卷叶/焦边识别(干旱/病害)

Security checks across malware telemetry and agentic risk

Overview

The skill’s plant-diagnosis workflow is real, but it silently creates or reuses user identity, sends identity-bearing requests to a cloud service, and stores tokens locally, so it should be reviewed before installation.

Install only if you are comfortable with the provider receiving plant images/videos or submitted URLs, creating or reusing an automatic identity, querying cloud report history, and storing service tokens in a local workspace database. Avoid sensitive media or internal/private URLs unless the service boundary is acceptable, and review or remove the local data directory if you uninstall.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions while its documented behavior clearly requires shell execution, file read/write, network access, and likely environment access. This creates a transparency and consent gap: users and hosting platforms cannot accurately assess or constrain what the skill will do before execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The advertised purpose is image-based plant diagnosis, but the skill also performs account/identity initialization, remote login-like actions, token handling, local SQLite persistence, and cloud history retrieval. This hidden expansion of scope is dangerous because it introduces credential, privacy, and persistence risks unrelated to the user-visible task, making abuse or unintended data collection harder to detect.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The script presents itself as a plant leaf curl/scorch diagnostic tool, but the core analysis path delegates to a generic pet-type workflow and even accepts values like cat and dog. This mismatch can cause incorrect model selection, misleading diagnoses, and unsafe downstream recommendations in an agricultural setting, especially if users rely on the output for irrigation, pesticide, or fertilization decisions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file implements a broad generic API wrapper for pagination, CRUD, arbitrary HTTP verbs, download URL generation, and user lookup, which materially exceeds the stated purpose of diagnosing leaf curl and scorch from agricultural imagery. Even if intended as a shared utility, exposing unrestricted network-capable helpers inside a narrowly scoped skill increases the attack surface and enables capability creep or misuse by other parts of the skill.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The add, edit, delete, http_post, http_put, and http_delete methods provide arbitrary remote resource modification using caller-supplied URLs and arguments, with no visible authorization scoping, endpoint restriction, or purpose limitation. In the context of a plant-diagnosis skill, these capabilities are unrelated and could be abused to alter external systems, exfiltrate data through network calls, or act as a generic proxy for unauthorized operations.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The get_user_by_username helper introduces user-account lookup functionality that has no clear relation to agricultural image analysis. In a skill with no stated identity-management purpose, this creates unnecessary access to potentially sensitive account metadata and expands the opportunity for enumeration or privacy abuse.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements shared user/account persistence even though the stated skill purpose is plant leaf diagnosis from images and optional soil moisture data. Collecting and managing account records outside the declared function increases attack surface, creates unnecessary sensitive state, and suggests hidden or excess capability not needed for the agricultural workflow.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores authentication-related tokens plus personal profile data such as real name, email, birthday, age, and sex, none of which is justified by a leaf-scorch diagnosis skill. Retaining these secrets and personal data in a local SQLite database materially raises privacy, credential exposure, and lateral-abuse risk if the workspace or database file is accessed by other components or users.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This utility implements identity resolution, reads local identity material, creates default user identities, and persists them, which materially exceeds the declared purpose of plant-leaf diagnosis. In a skill expected to analyze agricultural images, hidden account/identity lifecycle behavior is dangerous because it can silently bind users or workspaces to backend identities without informed consent or clear necessity.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The HTTP helper performs remote login/registration, injects identity and tokens into requests, retries authorization, updates local token state, and returns billing guidance, all of which are unrelated to leaf-curl/scorch diagnosis. This hidden control plane creates a broad data-exfiltration and account-manipulation surface and makes the skill more dangerous because users would reasonably expect image diagnosis, not background account operations.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code inspects agent workspace structure, infers agent identity, and creates workspace data and skills directories. For a leaf-diagnosis skill, this expands filesystem reach beyond what is needed for image analysis and increases the chance of unauthorized persistence, cross-agent interference, or unintended discovery of local environment structure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow states that uploaded attachments or media are automatically saved as local files, but the skill does not prominently warn users about this storage behavior. Silent local persistence of user-provided files can expose sensitive data, increase retention risk, and create unintended artifacts accessible to other processes or later sessions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill indicates that network URLs are passed to an external API service for automatic downloading, but this external transmission is not surfaced as a strong privacy/security warning. Sending user-supplied URLs to a third party can leak sensitive endpoints, internal resource references, or usage metadata, especially if users assume analysis is local.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill reads arbitrary local file contents or forwards remote URLs to an external analysis service without any visible user notice, consent flow, or data-minimization control in this code path. In an agent setting, this can cause unintentional disclosure of sensitive local media, metadata, or internal URLs to a third-party backend.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The script accepts a hidden `--api-key` argument and also accepts user-supplied `--api-url`, while providing no visible guidance on secure credential handling or where the key will be transmitted. Passing secrets on the command line can expose them through shell history, process listings, logs, or wrapper tooling, and the hidden nature of the argument makes accidental unsafe use more likely.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill reads an internal identity value from a local data file and uses it as part of open-id resolution without any user-facing disclosure. Hidden consumption of local identity artifacts is risky because it can silently impersonate or associate a user/workspace with backend activity, especially in a skill whose stated function is plant diagnosis.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This request path may transmit usernames, open IDs, tenant codes, skill platform identifiers, API keys, access tokens, and authorization tokens to remote services, with much of this assembly happening implicitly. The lack of explicit disclosure and the mismatch with the manifest make this especially dangerous because users of a leaf-analysis skill would not expect silent identity-bearing network traffic.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 输入要求:支持 jpg/png 图像或 mp4/avi/mov 视频,最大 10MB;建议同时上传整体形态与叶缘特写各一张 |
| 🧑‍⚖️ 结果性质 | 诊断结果仅作为植物逆境识别参考,疑似病害严重时建议结合实地踏查或专业植保咨询 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
83% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-leaf-curling-scorch-diagnosis-analysis"
description: "Using agricultural cameras to capture high-resolution images of plant leaves, AI vision techniques detect leaf curling direction (up-curling or down-curling) and the distribution of leaf-margin scorch (old vs new leaves, tip vs margin). | 通过农业摄像头拍摄植物叶片的高清图像,利用AI视觉分析技术检测叶片卷曲方向(上卷或下卷)、焦边(叶缘干枯)的分布特征(老叶/新叶、叶尖/叶缘),并可结合土壤湿度传感器数据(可选),综合判断卷叶/焦边的主要原因(干旱胁迫、病害如白粉病/病毒病、药害、肥害等)。系统定期巡检,发现卷叶或焦边时自动分析原因,输出诊断及建议(如'叶片上卷、叶缘焦枯,土壤湿度偏低,可能干旱,建议灌溉')。"
version: "1.0.9"
license: "MIT-0"
---
Confidence
79% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2