Back to skill

Security audit

Transpiration Rate Estimation | 室内绿植蒸腾速率估算

Security checks across malware telemetry and agentic risk

Overview

This plant-analysis skill should go to Review because it silently creates or reuses an account identity, stores authentication tokens locally, sends media or URLs to cloud services, and contains inconsistent pet/video documentation.

Install only if you are comfortable with this skill sending plant images/videos or supplied URLs to lifeemergence cloud services, silently creating or reusing an internal account identifier, storing auth tokens in the workspace data database, and using cloud history tied to that identity. Avoid using private URLs or sensitive media unless the publisher clarifies retention, token storage, account creation, and deletion controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
86% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and instructs use of shell, filesystem, network, and environment-backed capabilities without declaring permissions. This weakens the trust boundary for users and hosting agents because the manifest does not accurately communicate that uploads may be saved locally and data may be sent to remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The described plant-transpiration skill appears to perform unrelated identity creation, token persistence, remote account login/registration, and history/report retrieval, while omitting any local transpiration-specific logic. This mismatch is dangerous because it can trick users and agents into providing media and context to a workflow that secretly performs account-linked cloud operations and stores credentials or identifiers.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The referenced API documentation is clearly for pet health analysis, while the skill declares a plant transpiration-rate estimation purpose. This mismatch can cause the agent or integrators to call unrelated endpoints, mishandle data, or expose/report the wrong domain's information, creating a real integrity and potential privacy/security risk through cross-skill confusion.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation intent conflicts with the declared skill purpose, indicating the skill may be wired to the wrong backend capability or was assembled from unrelated material without proper validation. In security terms, this increases the chance of unauthorized data flow, incorrect API invocation, and operator confusion that could lead to misuse of credentials or accidental access to pet-health data paths.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The skill forwards arbitrary user-supplied HTTP(S) URLs to a backend analysis service without any visible allowlisting or restriction. If that backend fetches the URL server-side, this can enable SSRF-style access to internal resources, cloud metadata endpoints, or other unintended network targets through the analysis infrastructure.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The implementation materially diverges from the declared skill purpose: it performs generic video analysis and history listing rather than transpiration-rate estimation from plant imagery and environmental signals. This is dangerous because users, policy engines, or downstream agents may grant the skill permissions and trust based on the benign plant-analysis description while the code actually processes arbitrary local files/URLs and invokes a different backend behavior, creating a capability-misrepresentation and data-exfiltration risk.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The CLI text and docstrings explicitly describe a video analysis tool, contradicting the published plant transpiration-analysis skill description. Such inconsistencies are a security concern because they can conceal true capabilities from reviewers and users, increasing the chance that sensitive media or identifiers are supplied to an unexpectedly broad or different service path.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This helper exposes generic add/edit/delete and arbitrary http_get/http_post/http_put/http_delete wrappers that are far broader than the stated transpiration-analysis purpose. In an agent skill context, these capabilities can be abused to reach unintended internal or external endpoints, perform unauthorized data access or modification, and expand the blast radius if upstream inputs are user-controlled.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility layer performs external account provisioning, token acquisition, and authenticated platform communication that are unrelated to a plant transpiration analysis skill's declared purpose. In context, this creates hidden identity management and outbound data flow, expanding the attack surface and enabling undisclosed use of user/workspace identity and credentials.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The code reads data/smyx-api-key.txt, queries and writes a local user database, and persists a generated default identity. For a skill advertised as image/sensor-based transpiration estimation, this is unjustified stateful behavior that can silently create identifiers and store sensitive local state outside the expected analytic workflow.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill contains generalized workspace detection plus automatic creation/access of agent data and skills directories. In this skill context, that exceeds what is needed for image-based plant analysis and increases the ability of the code to discover, modify, or persist data in broader agent workspaces.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The history-report auto-trigger is defined with broad natural-language phrases, which can cause the skill to execute cloud report queries on ambiguous user requests. In a system that auto-runs skills, this can lead to unintended disclosure of prior report metadata or actions the user did not explicitly request.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill says uploaded attachments are automatically saved as local files but does not prominently warn users about this retention behavior. Silent local persistence of user-provided media increases privacy and data-handling risk, especially for image/video inputs that may contain sensitive surroundings or metadata.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs use of cloud APIs and says remote services will automatically download user-provided URLs, but it does not warn users that their inputs and URLs are sent to third parties. This creates privacy and data-governance risk and may expose internal or sensitive URLs if users provide non-public resources.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script silently resolves an internal user identity via OpenIdUtil.resolve_current_open_id while suppressing the corresponding CLI help, which creates undisclosed identity binding and potential cross-user data access. In combination with the --list path using ConstantEnum.CURRENT__OPEN_ID, an operator may retrieve analysis records tied to an implicit account without clear consent or visibility.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The function reads full local file contents and passes them, or a remote URL, to the analysis service with no user-facing disclosure or consent mechanism in this code path. In practice this can lead to unexpected transmission of sensitive local media or externally hosted content to a third-party/backend service, creating privacy and data-governance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code automatically resolves or creates a default open-id, potentially generating a new user identifier and persisting it for future reuse without user-facing disclosure. Hidden identity creation is privacy-relevant and can tie subsequent requests and records to a stable identifier the user never knowingly approved.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
HTTP request handling injects user identity fields and authentication headers (for example pnaUserName, X-Access-Token, X-Api-Key, Authorization) into outbound requests without user-facing disclosure in this skill. For a plant-health estimation tool, silent transmission of identity and auth context is disproportionate and risks privacy leakage, cross-service tracking, and credential misuse if endpoints or logs are compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 文件要求:支持 jpg/png/mp4/avi/mov 格式,最大 10MB;热成像建议使用伪彩或可解码的辐射图 |
| 🔎 使用提醒 | 拍摄要求:固定机位、稳定光照时段采集;尽量避免热源干扰(暖气、灯具直射、玻璃反射) |
| 🧑‍⚖️ 结果性质 | 分析结果仅供养护参考,不提供土壤水分具体数值;持续异常建议结合土壤水分计或根系检查 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📁 格式支持 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown 表格格式输出,包含"报告名称"、"植物类别"、"分析时间"、"点击查看"四列,其中"报告名称"列使用`蒸腾速率估算报告-{记录id}`形式拼接, "点击查看"列使用`[🔗 查看报告]()`格式的超链接,用户点击即可直接跳转到对应的完整报告页面。 |
Confidence
88% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-transpiration-rate-estimation-analysis"
description: "AI-powered transpiration rate estimation for indoor plants. From smart planters or fixed cameras, uses thermal infrared images of leaves (preferred) — or regular RGB images combined with ambient temperature/humidity — to estimate the leaf-to-air temperature difference, combines radiation/humidity parameters (sensor or model-inferred), and computes a relative transpiration rate index (0-100%). Transpiration rate correlates with root water-uptake activity, indirectly reflecting root health and water transport capacity. Helps determine whether the plant is water-stressed, has damaged roots, or is under environmental stress. Scenarios: smart planters, indoor green plant care, plant factories, research greenhouses. | 通过智能花盆或固定摄像头采集植物叶片的红外热成像图像(或普通RGB图像结合环境温湿度数据),利用AI模型估算叶片温度与空气温度的差值,结合辐射、湿度等参数(可由传感器提供或模型内估),计算植物蒸腾速率的相对值(0-100%)。蒸腾速率与根系吸水活力正相关,可间接反映根系健康及水分输送能力。该技能有助于判断植物是否缺水、根系受损或环境胁迫。应用场景:智能花盆、室内绿植养护、植物工厂、科研温室。"
version: "1.0.9"
license: "MIT-0"
---
Confidence
86% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2