Succulent Special State Detection | 多肉植物特殊状态识别

• Outcome: Review
• Latest audit: Oct 17, 2026 · 2:20 PM UTC
• Version: 1.0.14

Overview

The skill’s plant-analysis function is plausible, but it silently creates or reuses account identity, stores tokens locally, and queries cloud history, so it needs Review before installation.

Install only if you are comfortable sending succulent images or videos and related report history to the configured cloud service, and with the skill silently creating or reusing an account identity and storing authentication tokens in a workspace database. Review the publisher’s data retention and account-management expectations before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a narrow succulent-image diagnosis tool, but the documented and detected behavior includes generic remote API invocation, history listing, identity resolution, local persistence, and other unrelated capabilities. That mismatch is dangerous because users and orchestrators may grant trust and trigger the skill under false assumptions, enabling unexpected access to user data and broader system functions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest is narrowly about detecting three succulent abnormal states, but the implementation accepts a pet_type parameter and CLI choices cat, dog, and other, then writes that into a default constant. That behavior is semantically unrelated to succulent disease/growth-state analysis and suggests the skill code was repurposed from a pet-analysis context without matching the declared intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implementation materially diverges from the declared skill purpose: it processes video inputs and supports history retrieval rather than HD image-based succulent-state detection. This kind of scope mismatch is dangerous because it can mislead users and reviewers about what data is actually collected and transmitted, enabling unexpected handling of richer media and broader backend capabilities than disclosed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI help text and function naming present this as a video analysis tool, directly contradicting the manifest's image-based succulent detector description. Such contradictions undermine informed consent and security review, because operators may approve or run the skill under false assumptions about the media types and backend behaviors involved.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file exposes a broad, reusable network/CRUD service layer (add, edit, delete, generic HTTP verbs, pagination helpers) that goes well beyond the declared purpose of succulent image-state detection. In an agent-skill context, such extra capability expands the attack surface and could be repurposed to perform unrelated remote actions or interact with backend services not needed for image analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generic http_post/http_put/http_get/http_delete methods accept arbitrary URLs and arguments, enabling the skill to make remote requests unrelated to plant-state detection. In a plugin/agent environment, this can be abused for unexpected outbound communication, data exfiltration, or invoking sensitive internal or external APIs under the guise of a benign imaging skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file defines storage and retrieval of user account data including usernames, real names, email, birthday, and tokens, which is unrelated to succulent condition detection. In this skill context, collecting or persisting identity and authentication-like data is especially suspicious because it exceeds stated need and could enable user tracking, credential misuse, or privacy violations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Storing and updating profile attributes and token-bearing fields is unjustified for a plant diagnosis skill and creates direct privacy and secret-handling risk. If compromised or misused, these fields could expose personally identifiable information and reusable tokens, making the mismatch between capability and declared purpose materially dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code reads identity-like material from a workspace file and creates persistent local user identities when none exist. For a succulent condition detection skill, this is unjustified identity handling that can silently bind the environment to an external account model and create durable identifiers without user awareness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility performs remote account provisioning, token retrieval, token persistence, and authenticated API setup that are unrelated to the declared succulent image-analysis purpose. In the context of a plant-detection skill, hidden identity bootstrapping and outbound authenticated requests expand the trust boundary and can transmit user/workspace identity material to external services without clear necessity or disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares broad operational behavior that implies shell, network, local file, and environment access, but it does not explicitly scope or constrain those capabilities in the manifest. This weakens least-privilege guarantees and makes it harder for a host agent or reviewer to prevent misuse, especially because the workflow instructs command execution and cloud access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as image/video state detection, while the behavior also includes cloud-based retrieval of historical reports and report-link generation. This undisclosed data-access behavior expands the skill from analysis into account-linked record retrieval, creating privacy and overreach risk if invoked in contexts where only image inference was expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default trigger is broad enough that the skill may auto-run whenever a user provides any succulent image or video for analysis. Because the skill also appears to have network access, shell invocation, and account/history features, over-broad triggering can cause unintended data transmission or execution of a more powerful workflow than the user expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The history-query trigger phrases are broad and likely to overlap with ordinary requests to view reports, making accidental invocation of cloud record retrieval more likely. In a skill that internally resolves identity and accesses historical data, such ambiguity raises privacy risk and can surface account-linked information without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2