Back to skill

Security audit

Plant Leaf Disease Identification | 植物叶片病害特征识别

Security checks across malware telemetry and agentic risk

Overview

The skill is a cloud plant-disease analysis tool, but it also silently provisions and reuses an internal identity, stores tokens locally, and sends account-linked requests with limited user-facing control.

Review before installing. Expect submitted images, videos, or URLs to be sent to LifeEmergence cloud services and report history to be tied to an internally managed identity. Install only if you are comfortable with local SQLite storage of account records/tokens and automatic account-linked API calls; avoid using sensitive internal URLs or private media unless the publisher provides clearer retention and deletion controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises no explicit permissions, yet its documented behavior includes shell execution, network access, local file read/write, and environment use. This creates a capability transparency gap: reviewers and users may treat the skill as low-risk while it can persist files locally, invoke scripts, and communicate with remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow plant-leaf disease identification, but the skill also handles generic video/URL ingestion, history listing, local user identity creation, SQLite persistence, and remote auth/token workflows. That mismatch is dangerous because it hides data collection, account linkage, and backend interactions unrelated to the user-visible task, increasing privacy and abuse risk.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The implementation and user-facing behavior clearly perform video analysis, while the skill metadata claims plant leaf disease identification from still images. This mismatch is dangerous because users and orchestrators may grant the skill access, route data, or rely on outputs under false assumptions about its purpose, causing unintended data handling and trust-boundary violations.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The inline documentation and CLI arguments repeatedly describe a video-analysis tool, directly contradicting the advertised plant disease image skill. Deceptive or inaccurate interface text increases the chance of misuse, accidental disclosure of the wrong media type, and unsafe automation decisions based on incorrect capability labeling.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file exposes a broad, generic API client with arbitrary HTTP GET/POST/PUT/DELETE and CRUD-style wrappers that are not constrained to plant leaf disease analysis. In the context of a narrowly scoped image-diagnosis skill, this creates unnecessary capability expansion that could be abused by other parts of the skill to access unrelated internal or external services, move data, or perform unauthorized actions.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The get_user_by_username capability enables user account lookup that has no clear connection to plant disease diagnosis. Unnecessary identity-related functionality increases the risk of user enumeration, privacy violations, or use of the skill as a pivot for collecting account information.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This skill is for plant leaf disease identification, yet the module includes generalized local persistence for user/account records. Capability overreach is risky because it introduces unnecessary identity storage and statefulness unrelated to the declared function, increasing privacy exposure and the chance of hidden account tracking.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores identity and authentication-related fields such as username, realname, email, token, and open_token, which are not justified for an image-based plant disease classifier. Unnecessary collection and local storage of tokens materially increases the risk of credential exposure, account linkage, and privacy violations if the database is accessed or reused by other components.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility file implements account identity resolution, local user persistence, token handling, login/registration flows, and authenticated backend API access, which is materially unrelated to the declared plant leaf disease identification purpose. In a vision-analysis skill, hidden identity provisioning and backend account coupling substantially increase the risk of undisclosed data transmission, platform abuse, and unauthorized use of user/workspace identity state.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code can create or log in users automatically via _get_or_create_user and then persist/restore tokens for future authenticated requests. This creates an undisclosed identity lifecycle inside a skill, allowing the skill to act under a provisioned account without clear user intent, which is especially dangerous because the skill's advertised function is disease identification from images, not account management.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code inspects agent workspace layout, reads environment-derived workspace roots, and creates skills/data directories. While not inherently malicious, these capabilities are unrelated to plant disease diagnosis and expand the skill's ability to discover and manipulate local execution context, increasing the chance of cross-skill data exposure or persistence abuse.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The history-report trigger phrases are broad enough to match normal conversation, which can cause unintended retrieval of historical cloud-stored reports. In this context, that increases the chance of privacy leakage because report listing is tied to internal identity association and remote API access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that uploaded images/videos are automatically saved as local files, but does not prominently warn users in the description or consent flow. Silent local persistence of user-provided media is a privacy and retention risk, especially for sensitive farm, greenhouse, or home images.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill automatically performs cloud API queries and causes remote services to fetch user-provided URLs, but the description lacks a clear privacy/security warning. This can expose user data, metadata, and potentially internal or sensitive URLs to third-party infrastructure without informed consent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script initializes internal user identity through OpenIdUtil.resolve_current_open_id using a hidden/open-id-suppressed argument and current identity resolution without clear user disclosure. Hidden identity resolution can cause unintended account linkage, access to another user's historical analysis data, or privacy violations if operators do not realize the tool is binding requests to an internal identity context.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill uploads either full local file contents or a user-supplied remote URL to an external analysis service without any visible consent, warning, redaction, or trust-boundary disclosure in this code path. This creates a privacy and data-handling risk because users may unknowingly send sensitive local media or internal URLs to a third-party backend.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script accepts a remote URL and forwards it to an external analysis service without explicit disclosure of network transmission or privacy implications. This can expose sensitive media references or cause users to submit data to a third party without informed consent, especially when the skill is misrepresented as a benign plant-image tool.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request wrapper assembles and sends credential-bearing headers such as X-Access-Token, X-Api-Key, and Authorization to remote endpoints without any visible user disclosure or consent mechanism in the code. In the context of an image-diagnosis skill, silent authenticated transmission is more suspicious because users would not reasonably expect hidden account-linked backend calls beyond the stated analysis task.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill reads an internal identity value from data/smyx-api-key.txt and uses it as part of open-id resolution without informing the user. This creates hidden identity coupling to local workspace files and can cause requests to be tied to a persistent identifier the user did not knowingly provide.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持 jpg/png/mp4/avi/mov 格式,最大 10MB |
| 🔎 使用提醒 | **拍摄要求**:近距离、光线充足、病斑清晰;模糊/逆光/距离过远的图像无法得出可靠结果 |
| 🧑‍⚖️ 结果性质 | **识别结果仅供病害诊断参考,不提供具体化学防治方案**;专业用药请咨询植保专家 |
| 🔎 使用提醒 | 部分病害症状相似(如细菌性与真菌性叶斑),AI 识别可能存在不确定性,建议结合植物种类与环境综合判断 |
| 🔎 使用提醒 | 同一叶片可能存在多种病害混合感染,需结合症状综合判定 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
Confidence
81% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-plant-leaf-disease-identification-analysis"
description: "AI-powered plant leaf disease identification from high-resolution leaf images. Detects disease lesion features (color, shape, distribution, surface deposits) such as white powdery patches (powdery mildew), rust-colored spore pustules (rust), brown necrotic spots (leaf spot), and outputs the most likely disease type with confidence score. Helps users quickly diagnose plant diseases and take timely measures. Scenarios: plant factories, greenhouses, home gardening, farm inspection. | 通过拍摄植物叶片的高清图像,利用AI视觉分析技术识别叶片上的病斑特征(颜色、形状、分布),检测是否有白色粉状物(白粉病)、锈色孢子堆(锈病)、褐色坏死斑(叶斑病)等典型症状,输出最可能的病害类型及置信度。帮助用户快速诊断植物病害,采取防治措施。应用场景:植物工厂、温室大棚、家庭盆栽、园艺养护。"
version: "1.0.10"
license: "MIT-0"
---
Confidence
86% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2