Back to skill

Security audit

Rose Pest & Disease Detection | 月季/玫瑰常见病虫害识别

Security checks across malware telemetry and agentic risk

Overview

The skill can diagnose rose media through a cloud service, but it also silently creates or reuses an identity, stores token-like data, and retrieves cloud history in ways users should review before installing.

Install only if you are comfortable with rose images or videos being sent to the publisher's cloud service, URLs being fetched by that service, a local identity/user record being created or reused, and token-like credentials being stored in the workspace data directory. Ask the publisher to document account creation, token storage, retention, deletion, exact endpoints, and consent prompts before treating this as a low-risk plant-only tool.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
86% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
85% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no permissions while its documented behavior requires shell execution, network access, file reads/writes, and likely environment access. That mismatch prevents meaningful consent and review, and can hide sensitive operations such as local file persistence and remote API interaction behind an apparently harmless plant-diagnosis skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is narrow image-based pest detection, but the behavior expands into video handling, historical report retrieval, persistent identity creation, token storage, and remote login-style flows. This is dangerous because users may provide garden media without realizing the skill also creates accounts, stores identifiers locally, and queries cloud-linked history, creating privacy and security exposure well beyond the stated function.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The documented endpoints and scenario code are for pet health analysis, which conflicts with the stated purpose of this skill as rose pest and disease detection. This mismatch can cause the agent to call unrelated backend services, exposing or retrieving unintended data and leading to cross-domain data handling errors, especially since the export endpoint suggests access to full reports by ID.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The script exposes a history-listing capability through `show_analyze_list()` and the `--list` flag that is not described in the stated skill purpose. Hidden or undocumented data-access features increase the risk of unauthorized access to prior analysis records, especially when combined with internal identity resolution elsewhere in the script.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill resolves an internal user identity via `OpenIdUtil.resolve_current_open_id(...)` even though the advertised function is simple image analysis. Collecting or deriving internal identity without a clear need creates unnecessary privacy risk and can enable linkage to user history or backend records, especially given the separate list feature.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation materially diverges from the manifest: it performs generic video analysis and can also process remote URLs, rather than constrained rose pest/disease image analysis. This kind of capability mismatch is dangerous because it can mislead users, bypass policy review based on the declared purpose, and expose broader data-processing behavior than expected.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The history-listing function exposes prior analysis records via an open_id-driven lookup, but this capability is not disclosed or justified by the stated plant-disease detection use case. Undeclared retention and retrieval features increase privacy and data exposure risk, especially if identifiers are predictable, reused, or insufficiently access-controlled elsewhere in the stack.

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The CLI descriptions, function names, and user-facing messages repeatedly describe a video-analysis tool, directly contradicting the manifest's rose pest/disease detector claims. Such inconsistency is a security concern because reviewers and users may grant trust or permissions based on false functionality claims while the code performs broader or different operations.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This file exposes generic remote-operation helpers including add, edit, delete, and arbitrary http_get/http_post/http_put/http_delete methods that are far broader than the stated rose pest/disease detection purpose. In a narrowly scoped image-analysis skill, such unrestricted network wrappers increase the attack surface and could be reused by other code paths to contact arbitrary endpoints or perform unintended remote actions without clear justification.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The add, edit, and delete methods provide remote modification capability, including destructive operations, despite the skill being described as an image-based detection assistant for rose diseases and pests. This mismatch between declared functionality and implemented capabilities is dangerous because it enables state-changing external actions that users and reviewers would not reasonably expect from this skill.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file implements a generic persistence layer and user-account CRUD behavior that is far broader than a rose pest/disease image analysis skill needs. In this context, unexplained account storage materially increases attack surface, creates unnecessary retention of user data, and suggests capability creep inconsistent with the declared function of the skill.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores identity and secret-bearing fields including username, realname, email, token, and open_token, none of which are justified by the stated rose disease detection purpose. Collecting and persisting such data unnecessarily raises privacy and credential-handling risk, especially because tokens appear to be stored directly in plaintext-like form.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill exposes a general-purpose `ai_chat` capability that is unrelated to the stated rose pest/disease detection purpose, which expands the skill's operational scope beyond what users and reviewers would expect. In an agent ecosystem, hidden or unnecessary chat/invocation surfaces increase attack surface and can be repurposed for unintended prompt handling, data exfiltration, or policy bypass chains even if the current implementation is incomplete.

Intent-Code Divergence

Medium
Confidence
77% confidence
Finding
The docstring states that the function invokes `openclaw agent` via subprocess, but the implementation does not do so and instead uses a placeholder `result` object. This mismatch is dangerous because it obscures the code's real behavior, misleads reviewers about whether external command execution exists, and can hide future re-enablement of risky subprocess logic behind apparently harmless code.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility file contains account provisioning, token acquisition, user persistence, and authenticated remote API plumbing that are unrelated to rose pest/disease image analysis. That mismatch is dangerous because the skill can silently establish identities, reuse workspace credentials, and communicate with external services under the guise of a benign gardening function, increasing the risk of undisclosed data exfiltration or account abuse.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code reads workspace identity material from data/smyx-api-key.txt, inspects a local user database, and creates a default user context when none is provided. This can bind the skill to existing local identities without clear user awareness, causing unintended impersonation, account linkage, or use of sensitive local credentials beyond the skill's stated gardening purpose.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger rules use broad keywords for rose problems and report history, which can cause the skill to auto-activate unexpectedly. In this skill, unintended invocation is more dangerous because activation can lead to automatic file handling and cloud API/history operations, potentially processing user data without clear intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill sends user-provided media and retrieves historical reports via cloud APIs, but the description does not clearly warn users about remote processing, persistence, identity linkage, or report retrieval semantics. This creates a privacy vulnerability because users may unknowingly expose images, URLs, and historical activity to third-party services.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill forwards user-supplied remote URLs to a backend analysis service without any visible consent, warning, or restriction logic in this code. That creates a data-sharing/privacy risk and, depending on backend behavior, can also expand attack surface through untrusted external resource fetching.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code reads the entire local file and uploads it to the analysis service without any visible user-facing disclosure about transmission or retention. In a skill handling camera/media content, that can expose sensitive imagery or metadata beyond what users may expect, especially given the manifest's narrower description.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The delete method is a generic wrapper around a remote POST-based deletion operation and exposes destructive capability without any visible confirmation, scoping, or safety guard in this code. In the context of a rose disease detection skill, such hidden destructive behavior is especially suspicious because it is not aligned with the expected read/analyze-only workflow and could be used to delete remote resources unexpectedly.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill reads a credential-like file from the workspace to derive an internal identity without any user-facing disclosure or consent. In a rose pest detection skill, silent use of local identity material is especially suspicious because it is unnecessary for image classification and can surprise users by tying actions to stored credentials.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code assembles and transmits identity-linked data such as openId, mobile/username, and source to a remote service without visible user disclosure. Because the skill is presented as a plant health detector, undisclosed transmission of account-related data is a privacy and trust violation and could enable tracking or unauthorized account creation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2