Back to skill

Security audit

Seed Germination Rate Prediction Analysis | 种子发芽率早期预测

Security checks across malware telemetry and agentic risk

Overview

This skill does perform seed-germination cloud analysis, but it also silently creates or reuses an identity, contacts a remote account service, and persists tokens locally with limited user-facing disclosure.

Install only if you are comfortable with seed images/videos and report-history requests going to the publisher's cloud service, and with the skill silently creating or reusing an account-like identifier and storing service tokens in the workspace. Prefer a version that asks before upload/history lookup and clearly documents the remote endpoints, identity fields, token storage, and deletion process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
85% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and instructs use of file, shell, environment, and network-capable operations but does not declare permissions or clearly bound those capabilities. This creates a trust and review gap: an operator may treat the skill as low-risk while it can read local files, invoke scripts, and contact remote services.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill expands from image-based germination analysis into cloud history-report retrieval and report-link generation, which is a materially different capability involving remote data access. Scope expansion increases the chance of unanticipated data exposure and can surprise users who expected only local visual analysis.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script exposes a list-retrieval capability that is outside the advertised scope of image/video-based germination analysis. Because it returns historical analysis data keyed by an internal identity, this expands the attack surface and can enable unauthorized access to prior results or metadata if identity handling elsewhere is weak.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill silently resolves and uses an internal open_id even though the declared function is media analysis. Hidden identity binding can cause user data to be associated, queried, or exposed without informed consent, and it creates a privacy/security dependency unrelated to the user's requested task.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes generic add/edit/delete and raw HTTP GET/POST/PUT/DELETE wrapper methods that can interact with arbitrary URLs, which is far broader than a seed germination analysis skill requires. In an agent skill context, this unnecessary capability increases attack surface and could be abused by other components or prompt-driven flows to manipulate remote resources, call unintended internal APIs, or exfiltrate data.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The service is implemented as a broad remote API client rather than a narrowly scoped image-analysis helper: it can fetch download URLs, paginate arbitrary requests, and issue unrestricted HTTP methods to caller-supplied URLs. In the context of an AI-triggered skill, this mismatch is dangerous because it enables capabilities unrelated to the declared purpose, creating opportunities for server-side request abuse, unauthorized remote actions, and data exposure if upstream inputs are influenced by users or prompts.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
A seed germination image-analysis skill should not require a generic user-account DAO with persistent local user records and token storage. This unnecessary identity/storage capability expands the attack surface, increases the consequences of compromise, and creates unjustified handling of account-linked data unrelated to the stated function.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The model stores authentication-like tokens, open tokens, email, birthday, real name, age, and sex without any demonstrated need for seed germination analysis. Retaining this sensitive data locally raises privacy and credential-theft risks, and the lack of visible encryption, minimization, or retention controls makes the exposure more serious.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file for a seed germination analysis skill includes a generic `ai_chat` capability that is not scoped to the advertised task. Even though the subprocess execution is currently stubbed out, exposing a reusable free-form chat interface in shared skill code expands the attack surface and can enable prompt abuse, policy bypass, or unintended cross-skill capabilities if later wired up or inherited elsewhere.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This shared utility layer includes broad capabilities far beyond seed germination image analysis: identity resolution, local user persistence, token handling, login/registration flows, and arbitrary HTTP requests to external services. In the context of a narrowly scoped agricultural image-analysis skill, this unjustified capability expansion increases the blast radius for data exfiltration, account misuse, and hidden remote interactions without clear user consent.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code automatically posts user-derived identifiers to an external '/sys/phoneLogin' health endpoint with silent registration/login behavior. For a seed germination analysis skill, creating or accessing remote accounts is unrelated to the advertised function and can expose user identity data, trigger unauthorized account creation, and enable downstream token issuance without informed approval.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code reads identity data from workspace files, reuses local database user records, and can generate persistent default user IDs for later reuse. That persistence is not necessary for one-off tray image germination analysis and creates a hidden identity layer that can track users across sessions or silently bind activity to stored accounts.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default trigger is broad enough to activate on uploaded seedling-related media without strong evidence of user intent. Over-triggering can cause unintended processing of files and transmission to remote services, especially because the skill also supports automatic saving and cloud API interactions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill does not clearly warn users that local files or supplied URLs may be sent to a cloud API, and that history queries directly contact a cloud service. This undermines informed consent and can expose sensitive images, videos, metadata, or account-linked report history to external infrastructure unexpectedly.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Hidden internal identity resolution without user-facing disclosure is a privacy and security concern because it enables account-linked behavior that users do not expect from a local media-analysis command. In combination with list/history features, it can facilitate silent tracking or retrieval of user-associated records.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill reads arbitrary local file contents and transmits them to an external analysis service without any consent, warning, or confirmation in this code path. In an agent environment, this can lead to unintended exfiltration of local data if the input path is broader than expected or user understanding is incomplete.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
In debug mode, the utility logs request metadata and full response bodies, and globally enables urllib3/http.client debug output. Those logs may contain tokens, user identifiers, API responses, or other sensitive system data, which can then leak through console output, log collectors, or shared environments.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 图像/视频要求:支持 mp4/avi/mov/jpg/png 格式,最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供种子质量参考,不提供农业种植建议 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📁 格式支持 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown 表格格式输出,包含"报告名称"、"分析类型"、"分析时间"、"点击查看"四列,其中"报告名称"列使用`种子发芽率分析报告-{记录id}`形式拼接, "点击查看"列使用 `[🔗 查看报告]()` 格式的超链接,用户点击即可直接跳转到对应的完整报告页面。 |
Confidence
83% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-seed-germination-rate-prediction-analysis"
description: "Triggers when a user provides a seedling tray image or video for analysis; uses AI object detection to identify emerged seedlings (cotyledons breaking through soil or fully expanded), counts germinated seeds, and compares with total sown seeds to estimate germination rate. Application scenarios: smart seedling incubators, greenhouse nursery trays, home planting pots, seed company germination tests. | 通过育苗盘上方的固定摄像头,播种后连续采集土壤表面图像,利用AI目标检测模型识别出土幼苗,计数已发芽的种子数量,并与播种总数对比估算发芽率。应用场景:智能育苗箱、温室育苗盘、家庭播种盆、种子公司发芽试验。"
version: "1.0.9"
license: "MIT-0"
---
Confidence
79% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2