Succulent Special State Detection | 多肉植物特殊状态识别

• Outcome: Review
• Latest audit: Aug 28, 2026 · 6:10 PM UTC
• Version: 1.0.10

Overview

This skill is a plant-analysis tool, but it also performs cloud history lookup, silent identity creation/login, local token storage, and uses a default dev network configuration that users should review before installing.

Review this skill before installing. Use it only if you are comfortable with media and report queries being sent to external services, and check or change the bundled config so it does not use the dev 192.168.1.234 endpoints. Treat its local data directory and SQLite database as sensitive because they may contain identity and token material.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior includes shell execution, network access, local file read/write, and use of environment-derived/system-provided identity. This creates hidden trust and data-flow boundaries: operators and users may believe the skill is low-risk image analysis when it can also persist data locally and call remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior materially exceeds the stated purpose: besides succulent-state detection, it handles video/URL ingestion, historical report retrieval, persistent identity resolution/creation, and remote report-link generation. This mismatch is dangerous because reviewers and users cannot accurately assess what data is collected, where it is sent, or what side effects occur, increasing the risk of covert data processing and overbroad access.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest frames the skill as media analysis, but the body also includes cloud history lookup and report-link retrieval. That undisclosed secondary function can expose prior user records and expands the skill from stateless inference into account-linked data access, which changes the privacy and security posture significantly.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation introduces automatic identity initialization, reuse of a local default user, and possible creation of persistent local identity state, none of which is reflected in the manifest purpose. For an image-analysis skill, silent identity creation and persistence are risky because they can associate uploads and history queries with an unintended account without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatic local default-user creation/reuse is not justified by the core task of detecting plant conditions from media. This can cause cross-session data mixing, accidental access to another user's report history, and persistent tracking beyond what users would reasonably expect from a simple analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The skill exposes a history-listing capability via open_id that is not described in the manifest's detection-only functionality, increasing the attack surface beyond user expectations. Hidden or undocumented data-retrieval features can enable unauthorized access to prior analysis records if identity controls in downstream components are weak or bypassable.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code initializes and uses an internal user identity mechanism (open_id) unrelated to simple succulent diagnosis, introducing identity-linked behavior and possible data access paths. In the skill context, this is more dangerous because the manifest suggests a simple local/media analysis tool, so hidden identity handling may surprise users and facilitate cross-user report access if authorization is not strictly enforced elsewhere.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The skill exposes report enumeration and export-link generation functionality beyond the narrowly described plant-state detection use case. If upstream authorization is weak or missing, this broadens the attack surface by allowing users to discover prior analysis records and retrieve report artifacts that may belong to other users or contexts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the declared skill purpose: it behaves as a generic video-analysis and history-access tool rather than a succulent image-condition detector. This kind of scope mismatch is dangerous because users and platform controls may grant permissions or trust based on the manifest, while the code performs different data handling and capabilities than expected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The analysis-history listing capability is unrelated to the stated plant-detection purpose and can expose prior user activity or metadata through an undocumented side channel. Even if intended for convenience, hidden or unrelated data-access features increase the attack surface and violate least-privilege expectations for a narrowly scoped skill.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The CLI text and documentation present the tool as generic video analysis, contradicting the manifest’s succulent-image use case. Misleading documentation is security-relevant because reviewers and users may underestimate what data is processed, what inputs are accepted, and what external services are contacted.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes a generic HTTP wrapper and CRUD-style helpers that can send requests to arbitrary URLs, which is far broader than the declared purpose of succulent image condition analysis. In an agent skill context, this unnecessarily expands the capability surface to arbitrary network interaction and remote resource manipulation, enabling misuse for unintended data access, exfiltration, or interaction with external/internal services if higher-level code passes untrusted URLs or payloads.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The add, edit, delete, http_post, http_put, http_get, and http_delete methods provide unjustified remote resource management and arbitrary HTTP capabilities unrelated to detecting plant disease states from images. In a skill environment, such primitives can be repurposed to modify remote systems, probe services, or transmit sensitive data, making the skill materially more dangerous than its stated function suggests.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This file defines a shared local persistence layer for user-account records, including identity fields and account lookup logic, even though the declared skill is succulent image-condition detection. That capability mismatch increases the chance of undisclosed data collection, cross-skill state sharing, and misuse of locally persisted identity data in a context where users would not reasonably expect account management behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The User model stores and updates sensitive identity and authentication-related fields such as username, realname, email, token, and open_token, which are unrelated to succulent anomaly detection. In this skill context, collecting and persisting token material is especially dangerous because it creates unnecessary credential exposure risk, enables cross-context tracking, and could support unauthorized reuse if the local database is accessed by other components or an attacker.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file contains a general HTTP client that performs account lookup, token recovery, automatic login/registration, and authenticated remote requests, which is unrelated to succulent image-state detection. In this skill context, hidden identity bootstrapping and outbound service access greatly expands data exposure and creates an unexpected trust boundary, especially because requests are made automatically once local identity material is found or created.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code derives an identity from workspace files, global runtime state, or a local database, and if none exists it silently creates a new default identity for future use. For an image-analysis skill, silently establishing persistent identities is unnecessary and dangerous because it can track users across runs and enable unauthorized remote actions under a synthetic or reused account.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The workspace discovery logic walks environment variables and filesystem paths to locate agent roots, then creates shared data and skills directories automatically. While not directly exploitable on its own, this broadens the skill's reach into the agent environment beyond what a succulent detector should need, increasing the risk of unintended access, persistence, or cross-skill interference.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The default trigger is broad enough to auto-invoke on general succulent image/video requests, which can cause unintended processing and upload of user media to backend services. In the context of this skill, over-triggering is more dangerous because the skill also performs cloud interactions and account-linked history functions, so accidental invocation can have privacy consequences beyond simple local classification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill lacks a clear warning that uploaded media and report queries are processed via cloud APIs. This omission undermines informed consent: users may provide plant photos, videos, and request history without realizing content and metadata are transmitted to remote services and linked to persistent identity/account state.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code reads arbitrary local file contents and uploads them to an external analysis service without any consent, warning, or confirmation mechanism in this file. In an agent setting, this can lead to unintended exfiltration of user-local data if a caller supplies a sensitive path or if the media type validation is broader than the stated skill purpose.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code forwards a local file path or remote URL to an external analysis routine without any explicit notice, consent flow, or visible privacy boundary. In the context of a consumer plant-care skill, users may reasonably expect local image processing; silent transmission of media references to remote services can expose personal or environmental data beyond user expectations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The debug log prints the full prompt content, which may contain sensitive user data, internal instructions, API inputs, or proprietary image-analysis context. If debug mode is enabled in production or logs are collected centrally, this can leak confidential information to operators, log processors, or other tenants with log access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code reads a sensitive identity value from data/smyx-api-key.txt and uses it as an internal identity source without any user-facing notice. In this context that is risky because a plant-analysis skill should not silently harvest identity material from workspace files, and users would not reasonably expect local secrets to influence network-authenticated behavior.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The helper automatically posts identity data such as openId and mobile to a remote /sys/phoneLogin endpoint with register enabled, meaning it can log in or create an account without informed user approval. This is particularly dangerous for a succulent diagnosis skill because the transmission and account creation behavior is unrelated to the advertised purpose and may expose or create persistent user identities unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2