花卉识别与养护

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:34 AM UTC
• Version: 1.0.0

Overview

This plant-care skill mostly does what it advertises, but it has real review-worthy risks around credentials, local file upload, and unsafe generated HTML reports.

Review this skill before installing. Use only a dedicated DashScope API key, avoid environments where OPENAI_API_KEY is present, and only pass trusted plant image files. Be aware that images are sent to DashScope and embedded into a persistent HTML report; do not open generated reports from untrusted inputs until the HTML escaping issue is fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/flower_care.py:44

Finding

Cross-provider disclosure of an OpenAI API credential to DashScope

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/flower_care.py:72

Finding

Arbitrary local file disclosure through the image upload argument

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/flower_care.py:258

Finding

Stored script injection in generated HTML reports through unescaped model output

Content

View full analysis

🦠 {d.get('name', '未知病害')}

📋 症状：{d.get('symptom', '')}

💊 防治：{d.get('treatment', '')}

""" # Build tips HTML tips_html = "" if result.get("tips"): for i, tip in enumerate(result["tips"]): tips_html += f'

{i+1}{tip}

' # Replace placeholders difficulty = result.get("difficulty", "中等") diff_color = DIFFICULTY_COLORS.get(difficulty, "#999") html = html.replace("{{IMAGE_SRC}}", img_src) html = html.replace("{{PLANT_NAME}}", result.get("plant_name", "未知植物")) html = html.replace("{{SCIENTIFIC_NAME}}", result.get("scientific_name", "")) html = html.replace("{{FAMILY}}", result.get("family", "")) html = html.replace("{{PLANT_TYPE}}", result.get("plant_type", "")) html = html.replace("{{HEALTH_STATUS}}", result.get("health_status", "未知")) html = html.replace("{{HEALTH_NOTE}}", result.get("health_note", "")) html = html.replace("{{DIFFICULTY}}", difficulty) html = html.replace("{{DIFFICULTY_COLOR}}", diff_color) html = html.replace("{{DESCRIPTION}}", result.get("description", "")) # Additional template placeholders plant_type_icons = {"观花植物": "🌸", "观叶植物": "🌿", "多肉植物": "🌵", "水生植物": "🪷", "藤本植物": "🌱", "木本植物": "🌳"} html = html.replace("{{PLANT_TYPE_ICON}}", plant_type_icons.get(result.get("plant_type", ""), "🌺")) health_icons = {"健康": "✅", "一般": "🔔", "较差": "⚠️"} html = html.replace("{{HEALTH_ICON}}", health_icons.get(result.get("health_status", ""), "❓")) diff_pct = {"容易": "25", "中等": "55", "较难": "85"} h ...[truncated 3262 chars]

Remediation

View remediation

` sequences. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script reads credentials from environment variables and local config files, but that capability is not declared in the skill permissions. Undeclared secret access reduces transparency and can surprise users or hosts, especially in an agent ecosystem where least-privilege and explicit consent matter.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/flower_care.py (reported line 127)May include surrounding context.

python

- pest_control: 病虫害风险程度

如果图片中没有植物，has_plant设为false，其他字段留空字符串或默认值。"""
    return prompt


def call_dashscope(api_key, image_data_url, model="qwen-vl-max"):

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases such as '怎么养', '帮我看看这盆花', and generic plant-identification wording, which can cause the skill to activate in contexts the user did not intend. Because the skill can read files, write reports, run Bash, and send user-supplied images to an external API, unintended activation increases privacy and action-execution risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill instructions, prompts, examples, and output schema are primarily written to operate in Chinese, and the embedded API prompt requires Chinese response fields such as "健康/一般/较差" without stating this is optional. While some English trigger terms are listed, the file does not offer users a language preference or explain that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing overview says photos can be uploaded for identification but does not clearly disclose that the image and prompt content are transmitted to the external DashScope API. This creates a privacy and consent issue because users may share personal or sensitive images without realizing third-party processing occurs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation scenarios are described broadly and do not state when the skill must not run, making routing ambiguous. In an agent environment, this can lead to the skill being selected for loosely related messages and then performing filesystem access, shell execution, or external data transfer without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document declares lang="zh-CN", and the template's visible headings, labels, and status text are written in Chinese throughout. This imposes a specific language/locale on users without any indication of user selection, opt-in, or documented region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The knowledge base recommends specific pesticides and fungicides such as 多菌灵、代森锰锌、吡虫啉、阿维菌素, but it does not include a general warning about toxicity, PPE, ventilation, label-following, dosage limits, or keeping chemicals away from children and pets. In a consumer-facing plant-care skill, users may directly act on these recommendations, so omission of baseline chemical-safety guidance can contribute to unsafe handling or exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a DashScope-based flower-care tool, yet it also reads OPENAI_API_KEY as a fallback credential. Accessing unrelated credentials broadens secret exposure and could unintentionally route trust to a different provider namespace, which is unnecessary for the described functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt requires the model to respond entirely in Chinese, including field values and care guidance, and the rest of the script also presents user-facing output in Chinese. This enforces a specific language/locale without any user opt-in or documented region-specific justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script base64-encodes the supplied image and sends it to a remote third-party API without an explicit user-facing disclosure at the point of use. Photos can contain sensitive visual content or metadata-derived context, so undisclosed external transmission creates a privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

A language or locale policy issue can arise when a skill forces a specific language without user opt-in. This file presents all instructions in Chinese only, with no note that the content is region-specific or that alternative language support is unavailable.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:84