ClawHub
Back to skill

Security audit

Plant Species Recognition Skill | 植物物种识别技能

Security checks for vulnerabilities and agentic risk

Overview

This skill provides cloud-based plant media analysis, but it also silently creates or reuses identities, sends them to a vendor service, and stores cloud tokens locally.

Review before installing. Use it only if you are comfortable sending plant photos or videos and an internal user identifier to lifeemergence.com, and avoid placing secrets or real phone numbers in data/smyx-api-key.txt. Treat the local data/smyx-common-claw.db file as sensitive because it may contain reusable cloud tokens.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/util.py:410
Finding

Workspace identity or credential value is silently transmitted to a remote authentication service

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py:410-418, skills/smyx_common/scripts/util.py:450-465, and skills/smyx_common/scripts/util.py:543-558
Vulnerability Type: Unvalidated sensitive-data transmission
Risk Level: Medium

Vulnerable Code

python
@classmethod
def get_api_key_file_open_id(cls):
    """Read the internal identity value from data/smyx-api-key.txt."""
    api_key_path = os.path.join(cls.get_workspace_data_dir(), "smyx-api-key.txt")
    try:
        if not os.path.exists(api_key_path):
            return None
        with open(api_key_path, "r", encoding="utf-8") as f:
            value = f.read().strip()
        return value or None
    except Exception as e:
        CommonUtil.trace_exception_stack(e)
    return None
python
@classmethod
def resolve_current_open_id(cls, open_id=None, use_current=True):
    """Resolve and initialize the current open-id."""
    resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id
    if not resolved_open_id and use_current:
        resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME
    if not resolved_open_id:
        resolved_open_id = cls.get_api_key_file_open_id()
    if not resolved_open_id:
        resolved_open_id = cls.get_or_create_default_open_id()

    ConstantEnum.CURRENT__OPEN_ID = resolved_open_id
    if not ConstantEnum.CURRENT__USER_NAME:
        ConstantEnum.CURRENT__USER_NAME = resolved_open_id
    return resolved_open_id
python
def _get_or_create_user(username):
    _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin"
    open_id = username
    _data = {
        "silent": 1,
        "register": 1,
        "openId": open_id,
        "mobile": username,
        "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
    }
    try:
        _response = requests.post(_url, json=_data)
 
...[truncated 2377 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not use a file named smyx-api-key.txt as an identity source.
  2. Store the pseudonymous identity in a clearly named Skill-specific file, such as smyx-user-id.txt.
  3. Validate imported identifiers against a strict format, character set, and maximum length before use.
  4. Reject values resembling API keys, bearer tokens, phone numbers, or other credentials.
  5. Do not populate the mobile field unless the value is an explicitly supplied and verified telephone number.
  6. Prefer generating a random, Skill-scoped identifier locally when no identity has been supplied.
  7. Clearly disclose remote identity registration and obtain appropriate consent before transmitting an existing workspace identifier.
  8. Minimize remote logging and define a documented retention and deletion policy for identity values.

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/util.py:576
Finding

Cloud bearer tokens are persisted as plaintext in a workspace SQLite database

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py:576-600, skills/smyx_common/scripts/dao.py:175-190, and skills/smyx_common/scripts/dao.py:460-461
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code

python
if found_user:
    ApiEnum.TOKEN = found_user.token
    ApiEnum.OPEN_TOKEN = found_user.open_token
    current__user_name = found_user.username
if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
    new_current_user = _get_or_create_user(current__user_name)
    if new_current_user:
        ApiEnum.TOKEN = new_current_user.get("token")
        ApiEnum.OPEN_TOKEN = new_current_user.get("openToken")

        current_user_info = new_current_user.get("userInfo")
        if current_user_info:
            current_user_info["token"] = new_current_user.get("token")
            current_user_info["openToken"] = new_current_user.get(
                "openToken")
            user_model = User.load(current_user_info)

            user = user_dao.save(
                user_model
            )
python
if not db_path:
    db_path = "smyx-common-claw.db"

db_path = self.get_db_path(db_path)
self.engine = create_engine(f"sqlite:///{db_path}", echo=False)
python
token = Column(String(500), comment="token")
open_token = Column(String(1000), comment="open token")

Technical Analysis

The authentication response supplies token and openToken values. These bearer credentials are copied into a user model and stored as ordinary text columns in smyx-common-claw.db.

The audited implementation does not show encryption at rest, integration with an operating-system credential store, restrictive file-permission enforcement, or minimization of persisted token material. SQLite does not encrypt these columns by default.

Because the database is placed in the Agent workspace data directory, other local processes ...[truncated 1210 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer short-lived access tokens held only in process memory.
  2. Do not persist multiple equivalent bearer credentials unless both are strictly required.
  3. If persistence is unavoidable, use an operating-system-backed credential store.
  4. Where no credential store is available, encrypt tokens using authenticated encryption and keep the encryption key outside the database and project directory.
  5. Create the database and containing directory with owner-only permissions, such as 0600 for the file and 0700 for the directory on POSIX systems.
  6. Store token expiration metadata and remove expired credentials promptly.
  7. Implement server-side token rotation, revocation, narrow scopes, and short lifetimes.
  8. Avoid including the database in backups, diagnostics, archives, or support bundles without secret filtering.

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/util.py:563
Finding

Generic HTTP helper forwards authentication credentials to arbitrary absolute URLs

Content
View full analysis

Vulnerability Details

File Location: skills/smyx_common/scripts/util.py:563-568, skills/smyx_common/scripts/util.py:606-608, and skills/smyx_common/scripts/util.py:642-643
Vulnerability Type: Credential forwarding to an unrestricted destination
Risk Level: Medium

Vulnerable Code

python
try:
    headers = headers or {}
    if not url.startswith("https://") and not url.startswith("http://"):
        url = cls.BASE_URL + url
    headers['App-Id'] = ConstantEnum.APP__ID
python
headers.setdefault("X-Access-Token", ApiEnum.TOKEN)
headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY)
headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN)
python
response = requests.request(method, url, *args, json=data, params=params, headers=headers,
                            timeout=int(timeout), **argss)

Technical Analysis

RequestUtil.http_request() accepts any absolute URL beginning with http:// or https://. It then automatically attaches the configured access token, API secret, and authorization token before sending the request.

There is no destination-host allowlist, HTTPS-only rule, origin comparison, or explicit separation between authenticated vendor requests and unauthenticated external requests. Plain HTTP is accepted, which also exposes credentials to interception and modification by an on-path attacker.

The currently traced plant-analysis workflow uses fixed vendor API paths, and the command-line --api-url argument is not applied by recognize_plant(). Therefore, the reviewed command-line flow does not directly provide an unauthenticated user with URL control at this sink. Nevertheless, the shared request API exposes a concrete credential-disclosure primitive to any current or future caller that can influence its url argument.

Attack Path

  1. The Skill obtains valid TOKEN, OPEN_TOKEN, or API_SECRET_KEY values.
  2. Another caller, extensio ...[truncated 1049 chars]
Remediation
View remediation

Remediation Suggestions

  1. Maintain an explicit allowlist of authenticated API origins, including scheme, hostname, and permitted port.
  2. Require HTTPS for every request carrying authentication headers.
  3. Reject absolute URLs whose origin does not exactly match an approved vendor endpoint.
  4. Separate the implementation into an authenticated vendor client and an unauthenticated external-resource client.
  5. Attach each credential only to endpoints that require it; do not add all credentials globally.
  6. Disable automatic redirects for authenticated requests or strip credentials whenever a redirect changes origin.
  7. Validate the final URL after redirects and protect against DNS rebinding where untrusted hostnames can be supplied.
  8. Add tests confirming that tokens are never sent to HTTP endpoints, unapproved domains, alternate ports, or cross-origin redirects.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (63)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

HTTP request execution, authentication/open-id resolution, account creation/login, local filesystem access, and database-backed user storage are all sensitive capabilities that exceed the declared plant-recognition scope. In context, the mismatch is more dangerous because the skill also instructs automatic identity handling and remote history access, increasing the chance of silent data association and exfiltration.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

The YARA match indicates suspicious metadata/manifest characteristics associated with tool or MCP metadata poisoning patterns. In context, this is reinforced by the extensive description-behavior mismatch: a polished, domain-specific manifest may be serving as misleading packaging for broader capabilities, which can subvert trust and approval workflows.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "plant-species-recognition-analysis"
description: "Accurately identifies plant species from images based on deep learning and computer vision, outputs structured information including species name, family, growth habits and maintenance tips. | 植物物种识别技能，基于深度学习与计算机视觉技术，通过图像快速识别植物物种，输出物种名称、科属分类、生长习性及养护要点等结构化信息，为园艺、生态调研、自然教育提供专业识别服务"
version: "1.0.7"
license: "MIT-0"
---

# 🌿 Plant Species Recognition Skill | 植物物种识别技能
> **智能分析中枢** ·

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The privacy section claims raw media is deleted immediately after analysis, yet the workflow separately says uploaded attachments are automatically saved locally. This contradiction is dangerous because users may rely on a deletion promise that is not actually honored, leading to unexpected retention of potentially sensitive media on disk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation accepts a local file path or remote URL and explicitly treats the input as video content (for example by using the parameter name "videoUrl" and video-oriented error text), which contradicts the declared plant image recognition purpose. This kind of skill/manifest mismatch is dangerous because users may submit sensitive plant photos expecting local image recognition semantics while the code actually routes arbitrary files or URLs to a different backend workflow, creating unexpected data handling and trust-boundary violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The implementation materially differs from the published skill purpose: the manifest describes plant-species recognition from images, while this script performs video analysis and history listing. This mismatch can mislead users into supplying unintended inputs and can route data to a backend with capabilities and retention expectations that differ from the advertised skill, creating a trust and data-handling security issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file exposes a generic API wrapper with unrestricted CRUD and arbitrary outbound HTTP methods that are not aligned with the stated purpose of plant-species recognition from images. In an agent skill context, such capabilities can be repurposed to access, modify, delete, or relay data to unrelated services, substantially expanding the attack surface beyond image analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The add, edit, and delete methods provide generic resource-modification primitives without any demonstrated need for a plant identification skill. If reachable by the agent or downstream tool chains, they could be abused to alter or delete remote resources, enabling unauthorized state changes well outside the declared skill scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This file implements a generic local SQLite persistence layer and user-record management that is unrelated to image-based plant-species recognition. Unnecessary data storage broadens attack surface, enables silent collection of user information/tokens, and introduces persistence capabilities that an image-classification skill does not need. The context makes this more dangerous because the functionality is out of scope and therefore harder for integrators to expect, review, and secure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module includes creation, update, lookup, deletion, and counting of local user accounts, plus storage of token/open_token fields. For a plant-species-recognition skill, such account persistence is unjustified and creates clear privacy and abuse risk: data can be retained locally, modified, or enumerated without any visible plant-analysis need. Because this capability is hidden inside a broadly reusable DAO, it could be invoked by other parts of the skill stack in ways reviewers do not anticipate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This utility module contains user identity provisioning, token lifecycle handling, remote login/registration, local token persistence, and recharge/account-balance flows that are unrelated to plant species recognition. The mismatch in declared purpose versus actual capabilities increases supply-chain risk because installing a plant-analysis skill implicitly grants code that can manage identities and interact with external account systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code can generate synthetic local usernames, create local user records, and persist them for future API access. For a plant-recognition skill, silent account creation is a significant overreach that can create unauthorized identities, durable state, and hidden coupling to remote services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The HTTP helper performs remote phone-login/registration and stores returned authentication tokens, behavior unrelated to image-based plant analysis. This enables silent enrollment with a backend service and token acquisition, which could be abused for tracking, account misuse, or undisclosed external access under the user's environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares no explicit tool scope or permission boundaries while its documented behavior includes shell execution, network access, local file operations, and environment/config usage. In an agent setting, this materially increases risk because the runtime may grant broader capabilities than users expect, making misuse or overreach harder to constrain or audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

An ambiguous default activation rule makes it unclear when the skill should engage, which can cause it to process inputs or invoke backend services outside intended cases. Because this skill also has network, local-file, and history-query behaviors, loose activation increases the chance of unintended data handling.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2