Back to skill

Security audit

Plant Wilting Quantification (Underwatering / Overwatering) | 植物萎蔫程度量化(缺水/水多)

Security checks across malware telemetry and agentic risk

Overview

This plant-analysis skill performs the expected cloud media analysis, but it also silently creates or reuses an external identity and stores authentication tokens locally.

Review this before installing if you are not comfortable with a plant-analysis skill uploading media or URLs to lifeemergence.com services, silently creating or reusing an account-like identifier, and storing tokens in the workspace data directory. Use it only with media and report history you are willing to associate with that service identity.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no declared permissions, yet its documented behavior includes shell execution, local file read/write, network access, and environment use. This breaks least-privilege expectations and can mislead the hosting platform or users about the skill’s true trust boundary, especially because it also performs local persistence and remote API interaction.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is plant-image analysis, but the behavior extends into local identity creation/persistence, backend authentication or auto-registration/login, historical report retrieval, and link generation. This mismatch is dangerous because users may consent to benign image analysis without realizing the skill is creating accounts, storing identifiers locally, and sending data to remote services.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill expands from analysis into cloud-hosted historical report retrieval and report-link generation, which materially changes the data exposure surface. Historical queries can reveal prior user activity and produce externally reachable links, making the skill more privacy-sensitive than its manifest suggests.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
Automatic local file saving and output-file generation introduce storage and data-retention behavior beyond simple analysis. This is risky because uploaded images or derived results may persist on disk without clear user awareness, increasing the chance of unintended disclosure or accumulation of sensitive files.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The implementation materially diverges from the declared skill purpose: the manifest advertises plant-wilting analysis from images/sensors, while the code exposes a generic video-analysis and history-listing interface. This kind of capability mismatch is dangerous because it can mislead reviewers and users about what data is collected and processed, enabling unintended or undisclosed transmission of arbitrary video content to backend services.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The script’s user-facing descriptions repeatedly present the tool as a generic video-analysis utility, which conflicts with the skill’s stated plant-wilting purpose. While partly a documentation/integrity issue, this mismatch increases security risk by obscuring actual behavior and reducing informed consent, making it easier for broader data-processing functionality to slip past review.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This file exposes generic HTTP POST/PUT/GET/DELETE wrappers that can target arbitrary URLs, which is substantially broader than the stated plant-wilting analysis functionality. In an agent/skill context, this creates an unnecessary capability surface that could be repurposed for unintended network access, backend mutation, or data exfiltration if higher-level code passes attacker-controlled endpoints or parameters.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The user account lookup helper is unrelated to the declared plant-wilting analysis purpose and introduces unnecessary identity-oriented functionality. Even if intended for convenience, it expands access to potentially sensitive user information and can enable account enumeration or privacy violations when exposed through an agent workflow.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The file defines a concrete local user database with username, realname, email, token, and open_token storage, which is unrelated to plant-wilting image analysis. Functionality drift like this increases attack surface and creates unnecessary credential/token persistence in a skill that should not need account management, making misuse or data exposure more dangerous in context.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Persisting token and profile fields in a plant-care skill is unjustified and materially increases risk because secrets and personal data are stored locally without any visible encryption, access control, or retention limits. In this skill context, the mismatch strongly suggests overcollection and broadens the consequences of local file compromise or accidental data sharing.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs broad tokenized API access, implicit identity resolution, account provisioning, and remote request handling that are unrelated to plant-wilting quantification. In this skill context, that mismatch is dangerous because users would reasonably expect image/sensor analysis, not hidden account bootstrap and authenticated communications to external services.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code can silently create or log in external accounts using locally derived identifiers, then cache resulting tokens for future use. That is unrelated to the declared plant-analysis purpose and creates a hidden identity/authentication workflow that could enroll users or devices in an external service without clear authorization.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code injects payment/recharge guidance when a remote service returns status 402, which is outside the stated plant-health analysis capability. While not directly code-execution dangerous, it introduces monetization flow coupling that can manipulate users into installing additional skills or making payments they did not expect from this functionality.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill reads workspace identity material and persists synthetic default user identities in local storage to support later API activity, which exceeds what is justified for wilting analysis. This creates silent identity tracking and increases the chance of cross-session correlation or unauthorized use of a local persona.

Vague Triggers

Medium
Confidence
80% confidence
Finding
A default trigger that activates on generic plant image analysis requests is overly broad and can cause the skill to run when the user did not intend cloud processing, file saving, or historical lookup features. Overbroad invocation increases the likelihood of accidental data handling and unintended side effects.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that attachments may be automatically saved locally and that some queries must go to a cloud API, but it does not provide a clear user-facing warning about this data handling. Users may unknowingly submit plant images, videos, or metadata to persistent local storage and remote services, creating consent and privacy risks.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill reads arbitrary local file contents into memory and sends them, or a user-supplied remote URL, to an external analysis service without any user-visible consent, disclosure, or trust boundary warning in this file. In a skill advertised for plant analysis, this can lead to unexpected exfiltration of local media or server-side fetching of third-party URLs, increasing privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code sends user-supplied local files or URLs to `skill.get_output_analysis(...)` for external processing, but provides no explicit disclosure, consent prompt, or destination transparency to the user. In this skill context, that is more concerning because the manifest suggests plant-image analysis, while the code accepts generic video inputs that may contain sensitive scenes, people, or location details.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The function reads a workspace file `data/smyx-api-key.txt` and treats its contents as an internal identity value without any user-facing disclosure or confirmation. In context, this can silently appropriate a preexisting identifier from the environment and use it for downstream authentication flows unrelated to the advertised plant-analysis feature.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
HTTP requests automatically attach user identifiers and authentication headers (`X-Access-Token`, `X-Api-Key`, `Authorization`, `pnaUserName`) without clear user disclosure. For a plant-wilting skill, this hidden transmission materially expands privacy and trust risk because sensitive identity and auth data may be sent to remote services unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2