ClawHub
Back to skill

Security audit

Aquarium Plant Health Monitor | 水族箱水草健康监测

Security checks across malware telemetry and agentic risk

Overview

The skill does the advertised aquarium plant analysis, but it also silently creates or reuses account identity, stores backend tokens locally, and may send data to a default dev/private backend without clear user control.

Review this skill before installing. It is not just a local plant-health checker: it can upload media or URLs to a backend, query account-linked cloud report history, create or reuse a local identity, and store service tokens in the workspace data directory. Only install it if you accept those account and cloud data flows and verify the intended backend configuration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
Here, getattr(self.__model__, key) uses keys from the external filters dictionary, so untrusted callers may trigger access to unintended model attributes or ORM descriptors. While SQLAlchemy generally prevents classic SQL injection here, the lack of field allowlisting can enable unauthorized querying on sensitive columns and unstable behavior or exceptions, especially in generic code reused across contexts.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
This count() path has the same externally influenced dynamic attribute selection as list(), allowing callers to probe arbitrary model fields through filter keys. In a DAO handling user records and tokens, even metadata-only querying can facilitate enumeration of sensitive records or unexpected ORM behavior.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises no explicit permissions, yet its documentation clearly instructs use of local file handling, shell execution, environment-backed identity handling, network access, and cloud API queries. This mismatch weakens user and platform trust boundaries because the actual operational scope is broader than the manifest implies, increasing the chance of unnoticed data access or exfiltration through attachments, URLs, and report queries.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest presents the skill as a visual plant-health assessment tool, but the body also enables cloud-based historical report retrieval and report-link generation. This is a scope deception issue: users may consent to image analysis without realizing the skill also queries remote history data and returns cloud-backed artifacts tied to identity or prior activity.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill states it should provide only visual assessment, but its workflow additionally requires automatic local saving of uploaded media and cloud API access for history. That discrepancy creates hidden data processing beyond the apparent purpose of the skill, especially for sensitive user-uploaded files and prior report metadata.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation promises output limited to visual assessment, but later instructs the agent to provide report links and perform history queries. This inconsistency is dangerous because it can mask extra data retrieval and sharing behaviors under the guise of a narrower, safer feature set.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill advertises aquarium plant analysis, but it also exposes a hidden history-listing capability tied to user identity. This creates a scope mismatch and can enable unauthorized access to prior analysis data or metadata if users are not clearly informed and access controls are weak.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code initializes internal user identity and uses it for non-core operations unrelated to image analysis, which introduces hidden identity handling into a simple analysis tool. This increases privacy risk and may allow cross-user data exposure if identity resolution is implicit or misbound.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation materially diverges from the declared skill purpose: the manifest promises aquarium plant image analysis, but the code invokes a generic video-analysis path. This kind of capability mismatch is dangerous because it can hide unexpected data handling and broaden what users or orchestrators send to the backend, undermining trust and review assumptions.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code exposes a history-listing function for prior analyses that is not disclosed in the manifest. Undocumented access to historical outputs can reveal prior user data or metadata and creates a hidden capability that reviewers and users would not expect from a simple plant-health analysis skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill resolves an internal open_id/account context despite the stated task being aquarium plant analysis. Unnecessary identity/account coupling increases the risk of cross-user data exposure, hidden tracking, or unauthorized access to account-scoped history, especially when paired with the listing functionality.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The CLI and docstrings repeatedly describe a video analysis tool, directly contradicting the manifest's image-based aquarium plant monitoring description. Such inconsistencies are a strong indicator of repurposed or mislabeled code, which makes security review unreliable and can conceal broader or unrelated backend capabilities.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This module exposes generic CRUD wrappers and arbitrary HTTP methods that accept caller-supplied URLs, which materially exceeds the stated aquarium plant health analysis purpose. In an agent environment, this expands the skill into a general network client that could be abused for unauthorized outbound requests, data exfiltration, or interaction with unintended internal or external services.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The exposed http_post/http_put/http_get/http_delete methods provide arbitrary network request capability without any visible scope restriction tied to the plant-health monitoring workflow. In a skill runtime, such unrestricted egress can let a prompt, upstream component, or compromised caller repurpose the skill as a proxy to reach attacker-chosen endpoints, increasing SSRF-like and exfiltration risk.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file defines persistent user/account storage, including usernames and tokens, which is unrelated to the declared aquarium plant image-analysis purpose. This capability mismatch materially increases risk because it introduces unnecessary credential-like data handling into a skill that should not need identity persistence, broadening attack surface and raising concerns about hidden data collection.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Storing token and profile fields inside an aquarium plant monitoring skill is unjustified by the stated functionality and creates unnecessary exposure of sensitive user data. In this context, the mismatch makes the code more dangerous because hidden authentication/token storage is harder for users and reviewers to expect or audit.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs unrelated account provisioning, token acquisition, and persistence of remote-platform credentials despite the skill being described as aquarium plant image analysis. This creates unnecessary identity and network side effects, can silently register users or reuse local identities, and broadens the blast radius from local image processing to external account-linked operations.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code inspects OPENCLAW_WORKSPACE and derives workspace context from filesystem layout, which is unnecessary for simple aquarium plant diagnosis and can expose or couple the skill to agent-internal directory structures. In context, this increases sensitivity because the skill gains awareness of host workspace boundaries and can later use that knowledge to access data or install artifacts in agent-specific locations.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code reads a local identity file, falls back to local database records, and if absent creates a persistent default identity for future use. For an aquarium plant monitoring skill, silently binding execution to internal identities is unrelated and dangerous because it enables undisclosed tracking, remote account association, and persistent state creation without user awareness.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger is broad enough that ordinary discussion of aquarium plants with an attached image or video could invoke the skill automatically. Over-broad activation increases the risk of unintended file handling, remote API calls, or history operations without sufficiently specific user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow says uploaded attachments are automatically saved as local files, but the skill description does not warn users about this persistence. Silent local storage expands the privacy and security footprint of the skill and may retain sensitive media longer than users expect.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill requires cloud API queries and supports remote URL ingestion, but does not provide a clear privacy warning about sending data or metadata to external services. Users may unknowingly expose image contents, URLs, report history, and identity-linked activity to remote infrastructure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Hidden internal identity resolution without clear disclosure is dangerous because it silently binds execution to a user context the operator may not understand. In a skill that should only analyze local or remote media, this unexpected identity behavior raises privacy, auditability, and unauthorized data-access concerns.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
In debug mode, the code enables verbose HTTP/urllib3 logging and prints request metadata plus full response bodies, which may contain tokens, user identifiers, backend data, or operational details. Even though header output is partially reduced elsewhere, these logs still risk leaking sensitive information to console, log files, or shared agent output.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The code reads an internal identity value from a workspace file without any user disclosure, which is a privacy and transparency issue even if the immediate technical impact is limited. In combination with later authentication logic, this hidden read can feed identity reuse and external requests under an unsuspecting user's context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2