Security audit

blooming-elf 绽放精灵

Security checks for vulnerabilities and agentic risk

Overview

This plant-care skill is mostly purpose-aligned, but it needs Review because it reads and edits shared agent memory and uses broad triggers that could activate persistent data handling unintentionally.

Install only if you are comfortable with the skill storing plant-care state, home-environment details, reminder settings, document IDs, and file paths in shared agent memory. Prefer a version that uses a dedicated skill-scoped data file, asks before enabling weather lookups and automations, and narrows triggers to explicit plant-care requests.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:153
Finding: Shared Agent Memory Is Accessed and Modified Without Skill-Level Isolation
Content: View full analysis
- **IMA 已连接**（连接器可用 / 凭证就绪）→ 直接用 IMA 建档 > - **IMA 不可用** → 直接本地 `.md` 建档 > 建档后用一句话告知用户用了哪种方式，用户想换随时说。 - **IMA 可用**：`import_doc` 创建两个笔记 - 档案文档 ← 9 章空模板 - 日志文档 ← 空日志模板 - 记录 `档案笔记 ID` + `日志笔记 ID` 到 MEMORY.md - **IMA 不可用**：`Write` 创建本地 `.md` 文件 - 档案文件：`{用户指定路径}/{用户名} 植物档案.md` ← 9 章空模板 - 日志文件：`{用户指定路径}/{用户名} 养护日志.md` ← 空日志模板 - 用户不指定路径则默认 `工作目录/` - MEMORY.md 记录 `档案文件路径` + `日志文件路径` 代替笔记 ID ``` Line 417 makes modification of shared memory a mandatory completion step: ```markdown > ⚠️ **收尾必做**：把完整配置写入 MEMORY.md 的「## 绿灵配置」区块（首次写入会告知用户），并把 `配置状态` 设为 `✅ 已配置`。**漏写这步，下次对话会重新触发强制规则 1（新手引导无限循环）**。至少写入：城市、气候类型、种植环境、窗户朝向、温湿度计、空调/暖气、提醒时间，以及档案/日志的 ID 或路径。 ``` ### Technica ...[truncated 2914 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill persistently writes to local files and MEMORY.md, including user environment details, note IDs, locations, and plant history, without a clear up-front disclosure of what will be stored locally and modified. Silent persistent storage creates privacy and integrity risks: users may not realize sensitive context is being retained, and the agent may overwrite or append to files in ways the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The weather-enhanced flow sends city/location-related context to external weather services without clearly disclosing that external network requests may occur. This can expose user location metadata and usage patterns to third parties, especially when reminders run automatically in the background.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to enumerate and manipulate external IMA knowledge bases, folders, and related storage objects beyond the narrow minimum needed for a plant-care reminder. Broad storage-management capabilities increase the chance of over-collection, unintended data access, or writes to unrelated user content if the wrong IDs or folders are selected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes logic to retrieve shareable document links via media APIs and return them to the user. Generating shareable URLs can weaken access boundaries, create accidental disclosure paths, and expose persistent or time-limited links to sensitive notes if the wrong document is referenced or the user does not understand the sharing implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Triggers such as '帮我看看', '记一下', '状态不好', '太热了', and '太冷了' are common conversational phrases with broad meanings outside this skill's domain. Because the trigger list does not consistently constrain them to plant-care context, the skill risks unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger says the skill should guide setup on '首次对话或提及植物相关话题', which is extremely broad and can match ordinary mentions of plants rather than a clear invocation of this skill. The file does not provide limiting examples or exclusion conditions to distinguish casual plant discussion from intentional skill activation.
Content: No source excerpt is available for this finding.