Security audit

Plant Wilting Quantification (Underwatering / Overwatering) | 植物萎蔫程度量化（缺水/水多）

Security checks for vulnerabilities and agentic risk

Overview

The skill is a cloud media-analysis wrapper for plant wilting, but it silently creates/reuses an identity and stores tokens while sending user media to remote APIs.

Install only if you are comfortable with plant images or videos being sent to lifeemergence/open API services, cloud report history being tied to an automatically managed identity, and auth tokens being stored in a local workspace database. Avoid using it for sensitive media or shared workspaces unless the publisher documents retention, account handling, and token storage clearly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding describes broad local file access, workspace detection, identity persistence, remote login/account provisioning, authenticated API calls, and token management under the guise of a plant-analysis tool. This is dangerous because it combines multiple sensitive capabilities—filesystem, identity, authentication, and network—in a misleadingly narrow package, creating substantial opportunity for data leakage or abuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The implementation materially diverges from the stated plant-wilting image-analysis purpose: it accepts arbitrary local files or remote URLs, labels them as video inputs, and forwards them to a generic backend analysis API. This creates a deceptive capability boundary and can cause users to unknowingly exfiltrate unrelated local content or invoke unintended backend processing under a benign gardening-themed description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for quantifying plant wilting from full-plant images, optionally using soil-moisture data to assess dehydration versus waterlogging and trigger irrigation/drainage prompts. This file instead presents itself as a "视频分析工具", requires MP4 input or video URLs, and calls generic video-analysis/history APIs without any visible plant-, wilting-, image-, or sensor-specific logic.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file defines a full user-account persistence layer, including a User model and UserDao, which materially exceeds the stated purpose of a plant wilting quantification skill. Unnecessary account storage broadens the attack surface, introduces privacy risk, and creates opportunities for misuse or lateral functionality unrelated to plant-image analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema stores username, real name, email, token, and open_token data, none of which are justified by the skill's declared plant-wilting analysis function. Collecting and persisting token-bearing identity data without clear necessity or scope limitation creates significant privacy and credential-exposure risk if the local database is accessed or reused by unrelated components.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility code provisions remote accounts, performs authentication, caches tokens, and binds requests to a platform identity, which is unrelated to plant wilting analysis. In this skill context, hidden account creation and remote identity bootstrapping materially expand the trust boundary and can cause undisclosed data transfer, account misuse, and platform-side attribution under a generated or reused identity.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and documents capabilities that rely on shell execution, filesystem access, network access, environment access, and local persistence, but it does not declare any tool scope or permission boundaries. This is dangerous because reviewers and runtime policy engines cannot easily constrain what the skill is allowed to do, increasing the chance of over-privileged execution and abuse of local or remote resources.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill presents itself as analysis-focused but also includes cloud-hosted history retrieval and report-link output as a built-in capability. This is dangerous because it expands data flows and retention beyond immediate analysis, creating privacy and unauthorized-access risks if report listing is identity-linked or insufficiently authorized.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description does not clearly warn that uploaded images/videos and history queries are sent to cloud/API services. This is dangerous because users may provide sensitive media or expect local-only processing, while undisclosed remote transmission creates privacy, compliance, and data-sovereignty risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation states that uploaded attachments are automatically saved locally without a clear user-facing warning. This is dangerous because silent local persistence can expose sensitive files to other processes, backups, or later misuse, especially on shared or managed environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic local user creation and identity reuse adds account-management behavior not justified by the advertised purpose. This is dangerous because hidden identity management can create persistent tracking, broaden report access, and undermine user expectations about a one-off analysis tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatic creation and reuse of a default local user identity is outside the expected scope of a plant-analysis skill. This is dangerous because it introduces silent account/state persistence that can link separate actions together and enable unintended access to prior reports or data.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2