Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to perform cloud-based plant media analysis, but it also silently creates or reuses identity state, stores tokens locally, and exposes broader video/history/account behavior than a simple leaf-disease classifier implies.
Review this carefully before installing. It is not just a local plant-image classifier: it can upload media or URLs to a remote service, create or reuse an internal user identity, store authentication tokens in a local SQLite database, and query cloud report history. Install only if you are comfortable with that account linkage and remote processing model, and avoid using private images, private video, or internal URLs unless the publisher’s data handling is acceptable to you.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
Authentication/token handling, open-id persistence, directory discovery, filesystem access, and remote account registration/login are highly sensitive capabilities that do not belong in a narrowly described plant-analysis skill. This is especially dangerous because users may provide media believing they are using a simple classifier while the skill also manages identities and remote accounts behind the scenes.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-plant-leaf-disease-identification-analysis"
description: "AI-powered plant leaf disease identification from high-resolution leaf images. Detects disease lesion features (color, shape, distribution, surface deposits) such as white powdery patches (powdery mildew), rust-colored spore pustules (rust), brown necrotic spots (leaf spot), and outputs the most likely disease type with confidence score. Helps users quickly diagnose plant diseases and take timely measures. Scenarios: plant factories, greenhouses, home gardening, farm inspection. | 通过拍摄植物叶片的高清图像，利用AI视觉分析技术识别叶片上的病斑特征�
The manifest describes a skill that analyzes high-resolution plant leaf images and returns likely disease type with confidence. In code, the input handling and user-facing text repeatedly refer to videos and generic analysis reports: it accepts a 'network video URL'/'local video path', sends a 'videoUrl' parameter, and exposes generic report-list/report-export functions instead of a plant-disease-specific diagnosis flow. This is a strong semantic mismatch between the declared purpose and the implemented behavior.
The implementation behavior materially conflicts with the declared skill purpose: it accepts MP4 video paths/URLs, invokes video-analysis routines, and exposes video-history listing rather than plant leaf image disease identification. This can misroute user data to unintended processing, create unauthorized handling of video content, and violate user trust or platform policy because operators and users would reasonably expect leaf-image diagnosis only.
This module provides broad local database CRUD and account-management capability unrelated to plant leaf disease image analysis. In the stated skill context, unnecessary user persistence expands the attack surface, enables unauthorized retention of personal data, and creates hidden state that can be abused by other components or agents.
The User model stores identity and credential-like fields including email, token, and open_token, which are unjustified for a leaf disease identification skill. Storing such secrets locally increases the risk of credential disclosure, cross-skill tracking, and misuse of accounts if the SQLite database is accessed by other code in the workspace.
The code automatically resolves, reads, and if necessary creates persistent user identity state via local files and a database, despite the skill being presented as an image-based plant disease detector. This hidden identity lifecycle can deanonymize users, enable cross-session tracking, and prepare credentials for later outbound requests without clear necessity or consent.
This utility code performs remote account provisioning, token management, and authenticated API access that is unrelated to the stated purpose of plant leaf disease image analysis. The mismatch in declared functionality versus actual behavior greatly increases supply-chain risk because installing the skill can silently create identities, persist credentials, and transmit user-linked data to remote services.
The code sends identity-related fields such as openId/mobile to a remote endpoint to silently log in or register a user, without any visible disclosure or confirmation. In the context of a plant disease analysis skill, this is especially concerning because users would not reasonably expect remote identity enrollment as part of image diagnosis.
The skill declares no explicit tool scope even though the manifest instructs use of shell, filesystem, environment, and network-capable code paths. That creates an over-privileged and weakly governed execution surface where callers and reviewers cannot easily constrain what the skill may access.
The description is presented bilingually in Chinese and English, but the skill does not state that the user may choose their preferred response language or locale. For language-policy compliance, skills should explicitly offer or preserve user language preference rather than implicitly imposing a fixed bilingual format.
The default trigger condition is broad enough that the skill may auto-activate on generic plant-image requests without clear user intent. Over-broad triggering is risky because it can cause unintended file handling, network calls, or report lookups in contexts where the user did not explicitly request this skill.
The code accepts both local/remote URLs and treats them as valid inputs, while the manifest describes only high-resolution leaf images. Accepting arbitrary URLs broadens the attack surface because downstream processing may fetch attacker-controlled resources, potentially enabling SSRF, internal network access, or ingestion of unsupported content; video acceptance also materially differs from the declared scope.
Detected: suspicious.install_untrusted_source