Back to skill

Security audit

Plant Root Health Analysis (Transparent Pot) | 植物根系健康状况(透明盆)

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised cloud plant-root analysis, but it also silently creates/reuses account identity, stores tokens locally, and exposes report-history access with incomplete user-facing disclosure.

Install only if you are comfortable with the skill sending root images/videos or URLs to the vendor cloud service, creating or reusing a local/remote identity without prompting, storing account tokens/profile data in a shared workspace database, and retrieving cloud report history. Ask the publisher to document identity creation, token storage, retention, and the pet-health code remnants before trusting it in a sensitive workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
72% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions while its documented behavior and associated code capabilities imply shell execution, filesystem access, environment access, local writes, and network communication. This undermines least-privilege review and can cause users or hosting platforms to authorize a skill without understanding that it can save files locally, call remote services, and access local state.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow plant-root visual analysis, but the behavior expands into generic remote delegation, local/remote identity management, token storage, history retrieval, and unrelated pet-type handling. This is dangerous because users and reviewers may trust the skill with plant images while it actually performs broader account, storage, and remote-processing actions that increase privacy, credential, and supply-chain risk.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Automatic identity initialization, reuse, and creation is not necessary for a simple root-image analysis skill and introduces hidden account linkage and persistence. In this context, silently creating or reusing identities increases privacy risk and can bind user actions and reports to local or remote accounts without clear consent or visibility.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill expands beyond image analysis into cloud history lookup and report-link generation, which changes the data-handling model from local inference to ongoing remote account/report access. That broader functionality increases exposure of user data and historical records, especially because it is presented as part of a benign plant-diagnosis workflow.

Description-Behavior Mismatch

Low
Confidence
84% confidence
Finding
The skill states that uploaded attachments are automatically saved locally, but this persistence is not prominent in the high-level description. Hidden local retention can surprise users and create residual privacy risk if images or videos remain on disk longer than expected.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
A plant-root analysis skill documenting a --pet-type parameter with values other/cat/dog indicates code reuse or backend multiplexing inconsistent with the claimed function. That mismatch is risky because it suggests the skill may route data through a broader generic service than advertised, weakening trust boundaries and making behavior harder to audit.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The documented API is clearly for pet health analysis while the skill metadata claims plant root health analysis. This mismatch can cause the skill to call unrelated backend functions, expose or process data under the wrong business domain, and mislead reviewers about what the skill actually does. In a security review context, cross-domain documentation inconsistencies are dangerous because they can conceal repurposed integrations or unauthorized access to another product's APIs.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation exposes behavior and terminology for 'pet health analysis' and account-scoped listing rather than the manifest’s stated plant-root analysis purpose, indicating capability drift and possible code reuse from another domain. This mismatch is dangerous because users and reviewers may approve the skill for low-risk image analysis while it actually interfaces with broader historical analysis functionality, increasing the chance of unauthorized data access or deceptive processing.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The inline comments and CLI output reference internal user identity handling and pet health analysis, which contradicts the declared purpose of a simple plant-root analyzer. Such contradictions are a security concern because they suggest hidden functionality or repurposed code paths that may process user-linked data without clear disclosure, undermining informed consent and accurate review.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The script includes an account-scoped listing feature via hidden open-id handling and `get_output_analysis_list`, which is not justified by the manifest’s stated single-input image/video analysis function. This is dangerous because it expands the skill from content analysis into retrieval of prior user-linked records, potentially enabling unauthorized access to historical data or metadata if identity resolution is weak or manipulated.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill exposes report-history listing and report-export URL generation that go beyond the declared root-health analysis purpose. Hidden or undocumented data-access features increase the chance of unintended report disclosure, especially if callers can enumerate prior analyses or retrieve export links without clear authorization boundaries.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This file exposes broad generic network capabilities—add/edit/delete plus arbitrary http_get/http_post/http_put/http_delete wrappers—that are not justified by the stated root-health analysis purpose. In a skill that should mainly process plant imagery and return health assessments, these helpers materially expand the attack surface by enabling unrelated remote actions or data access if invoked by other skill code.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The get_user_by_username capability is unrelated to plant root inspection and introduces access to user-account lookup behavior without any visible business need in this skill. Even if benignly inherited from a common library, unnecessary identity-related functions increase the risk of user enumeration, privacy exposure, or lateral use beyond the manifest's declared scope.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module persists user/account records in a skill whose declared purpose is plant root-health analysis, creating a strong mismatch between stated functionality and actual data handling. Unnecessary identity storage increases privacy risk, broadens attack surface, and may enable covert tracking or cross-skill data correlation through the shared workspace database.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores authentication-like tokens and personal profile data such as username, real name, email, birthday, age, and token values without clear justification from a root-health imaging skill. Collecting and retaining this data in a local shared database can expose sensitive credentials and personal information if the workspace is accessed by other components or compromised.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility code manages user identity resolution, token retrieval, token persistence, workspace discovery, and authenticated remote API access that are not necessary for local plant-root image analysis. This materially expands the skill's data-access and network-exfiltration surface, enabling collection and reuse of identities/tokens across runs and workspaces. Because the advertised skill is root-health analysis, this hidden account/session plumbing is especially suspicious and unjustified by context.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The _get_or_create_user() helper silently registers or logs in platform users by posting openId/mobile identifiers with silent=1 and register=1. Creating remote accounts without a clear user action or need is dangerous because it can unexpectedly disclose identifiers to a third party and establish persistent accounts/tokens outside the user's awareness. For a root-analysis skill, this is unrelated functionality and therefore more concerning.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The code enumerates agent workspace structure, inspects OPENCLAW_WORKSPACE, parses internal pack/agent paths, and locates data/skills directories. While not inherently malicious, this exceeds what is needed for transparent-pot root analysis and increases the skill's ability to discover local filesystem layout and access shared workspace artifacts, which can facilitate later credential or data harvesting. The mismatch with the stated skill purpose raises risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Automatically saving uploaded attachments locally without a clear user warning creates a privacy and data-retention issue. Root images/videos may seem low sensitivity, but local storage can still expose user files, device paths, metadata, and unintended retained content to other processes or later users of the system.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill accepts network URLs and performs cloud history queries without clearly warning that user-supplied content and metadata may be transmitted to remote services. In a seemingly harmless plant-analysis context, this hidden remote transfer can still leak uploaded media, report history, and account-linked activity.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code resolves an internal current open ID without meaningful user-facing disclosure, while suppressing related CLI help. Hidden identity resolution is risky because it can cause users to unknowingly operate on or retrieve account-scoped data, and it obscures privacy-relevant behavior from both end users and reviewers.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The code reads arbitrary local file contents and sends them to the analysis backend without any visible consent, warning, or minimization controls in this file. In a skill intended for root imagery, this creates a privacy and data-handling risk because users may not realize local media is being uploaded off-device.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script accepts a hidden `--api-key` parameter while suppressing it from help output, giving users and reviewers little visibility into credential use. Hidden credential paths increase the risk of accidental secret exposure, undisclosed remote authentication, and insecure operational practices, especially in agent or automation environments where arguments may be logged.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2