Security audit

花卉识别与养护

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its flower-identification purpose, but it uses broader credentials than necessary and generates an HTML report from untrusted AI output without enough privacy or safety guardrails.

Review this skill before installing. Use a dedicated DashScope key only, avoid running it in an environment where OPENAI_API_KEY is set, and assume any uploaded plant photo is sent to DashScope and copied into the generated HTML report. Treat chemical pest-control advice as informational only and follow product labels and local safety rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Using OPENAI_API_KEY as a fallback credential for a different service broadens secret exposure and encourages cross-service credential reuse. A skill meant for flower identification should not probe unrelated generic API secrets, because this normalizes harvesting broadly named credentials that may belong to other integrations.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill falls back to reading OPENAI_API_KEY even though its documented purpose is to call DashScope. This broadens credential access beyond least privilege and can cause an unrelated, more sensitive credential to be consumed or exposed through downstream requests, logs, or error paths.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill searches home-directory config files for API keys automatically, including locations outside the immediate runtime input. This expands its access to local secrets without necessity for the stated flower-care function and increases the chance of unintended secret use or leakage.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list is very broad and overlaps with ordinary plant-related conversation, increasing the chance of unintended activation. Because this skill can invoke Bash, write files, and send user-supplied images to an external API, accidental triggering has privacy and execution-surface consequences beyond a simple UX issue.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The documented activation scenarios include ambiguous conversational phrases that do not establish clear trigger boundaries. In context, accidental activation could lead to reading local files, invoking scripts, and transmitting image data to a third-party service without the user realizing this skill was selected.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill does not clearly warn that uploaded images may be transmitted to DashScope for analysis. Photos often contain sensitive metadata or background content, so omission of this disclosure can cause users to share private data without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The knowledge base recommends specific pesticides and fungicides such as 多菌灵、代森锰锌、吡虫啉、阿维菌素, but does not include any accompanying warning about toxicity, protective equipment, ventilation, dosage verification, or keeping treated plants and chemicals away from children and pets. In a consumer-facing plant-care skill, this omission can lead users to apply hazardous substances unsafely, increasing risk of poisoning, skin/eye exposure, or environmental misuse.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The file advises use of chemicals such as ferrous sulfate, aluminum sulfate, lime, and potassium-phosphate fertilizers without a general handling warning. These substances are common horticultural inputs, but in a broad end-user skill their mention without dilution, labeling, or safe-handling cautions can still cause misuse, irritation, overapplication, or unsafe storage around children and pets.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:84