Crop Fruit Ripeness Grading | 经济作物果实成熟度分级

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:48 PM UTC
• Version: 1.0.10

Overview

This skill appears to perform cloud-based fruit ripeness analysis, but it also silently manages identity, account tokens, report history, and persistent local state in ways users should review first.

Review this before installing if you are not comfortable with a skill uploading media or URLs to a remote service, creating or reusing an internal identity, storing account tokens in a local SQLite database, and querying cloud report history automatically. The dev/private HTTP endpoint configuration and unclear token-retention controls should be resolved by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: Here getattr(self.__model__, key) uses keys taken from the caller-provided filters dictionary, so untrusted input can select arbitrary model attributes. While SQLAlchemy still parameterizes values, this can enable unauthorized querying on sensitive columns, trigger exceptions for invalid attributes, and weaken intended access control boundaries if higher layers pass user-controlled filters directly.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 81% confidence
• Finding: The count() method repeats the same caller-controlled dynamic attribute lookup pattern as list(), allowing external input to drive which model fields are queried. This is dangerous in a generic DAO because it can expose metadata about sensitive records and create reliability or authorization issues when integrated into higher-level features.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior includes shell execution, network access, local file read/write, and environment use. This creates a material trust and review gap: operators may approve or run the skill under the assumption it is low-risk, while it can actually upload files, persist data locally, and invoke external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to perform visual ripeness grading, but the documentation reveals substantially broader behavior: remote backend calls, URL/video ingestion, historical report retrieval, and hidden identity/account handling with local persistence. This mismatch can mislead users and reviewers about what data is processed, stored, and transmitted, increasing the risk of unauthorized data exposure and overbroad access.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The top-level description presents a narrow image-analysis function, while the body adds cloud-based historical report retrieval and report-link generation. That hidden expansion of scope matters because it changes the data-access model from one-shot inference to account-linked record access, which can expose historical data and metadata beyond the user's immediate upload.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The CLI exposes pet-oriented arguments and help text in a skill declared for fruit ripeness grading, creating a strong semantic mismatch between manifest, interface, and expected behavior. This can mislead users and downstream agents into invoking unintended analysis paths or handling data under the wrong assumptions, which is a security-relevant integrity issue in agent skill ecosystems.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code calls generic/list analysis flows that are inconsistent with a fruit-ripeness-only skill, suggesting capability bleed or reuse from another domain. In an agent setting, this can expose unrelated data views or trigger unintended operations, weakening least-privilege and making behavior harder to reason about safely.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: Contradictory inline documentation that describes pet-oriented analysis inside a crop ripeness skill is a trust and safety problem because operators may rely on help text to understand data handling and intended use. Such mismatches are especially risky in autonomous or semi-autonomous toolchains, where metadata and help output influence tool selection and user consent.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The skill’s declared purpose is fruit ripeness grading, but the implementation accepts arbitrary local files and remote video URLs for backend analysis. This creates a significant capability mismatch: users or integrators may expect simple local image/feature grading, while the skill can ingest broader media sources and transmit them externally, increasing data exposure and abuse potential.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code accepts arbitrary http/https URLs and forwards them for analysis, even though remote network retrieval is not obviously necessary for a fruit-ripeness grading skill. This can expand the attack surface by enabling unexpected outbound processing of third-party content, including sensitive URLs or internal resources if the downstream service fetches them.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The skill includes report listing and report export URL generation capabilities that go beyond the stated task of returning a ripeness grade. These extra data-access functions may expose historical analysis records or report artifacts to callers who only expected a single-use grading function, increasing the risk of unintended data disclosure.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation materially diverges from the declared skill purpose: instead of fruit ripeness grading, it exposes a generic video analysis/history CLI and forwards user-supplied inputs to another backend via skill.get_output_analysis / get_output_analysis_list. This kind of capability mismatch is dangerous because it can conceal undeclared data flows, broader media processing behavior, and history enumeration features that users and reviewers would not expect from the manifest.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstrings, argument descriptions, and CLI messages repeatedly present this as a generic video analysis tool, which reinforces that the shipped behavior does not match the advertised fruit-ripeness use case. Misleading user-facing text increases the risk of deceptive consent and operational misuse, because an operator may provide media or credentials under false assumptions about what the skill actually does.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes a generic remote-operation wrapper with create, update, delete, and arbitrary HTTP GET/POST/PUT/DELETE methods that are far broader than the declared fruit-ripeness grading purpose. In a skill context, such excess capability increases the attack surface and can be abused to exfiltrate data, modify remote resources, or act as a hidden proxy for unrelated network actions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The user lookup helper introduces account-related functionality unrelated to fruit-ripeness analysis, which is a strong indicator of overprivileged or repurposable code. Even if intended for convenience, it can enable user enumeration or unauthorized retrieval of identity data when embedded in a skill that should not need account discovery.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This shared configuration code pulls environment-derived user identifiers and messaging IDs into globally accessible constants even though they are unrelated to fruit ripeness grading. In a shared skill framework, that creates unnecessary collection and propagation of identity data, increasing privacy exposure and the risk that downstream code logs, transmits, or misuses those values.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file defines a reusable user/account DAO and user table inside a skill whose stated purpose is fruit ripeness grading. The mismatch substantially increases suspicion because it introduces identity and persistence capabilities unrelated to the declared function, expanding attack surface and creating opportunity for covert collection or retention of user data.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The model stores token and open_token fields even though authentication state is not justified by a fruit ripeness analysis skill. Persisting tokens in a local SQLite database increases the risk of credential leakage, session hijacking, and improper cross-skill data reuse if the database is accessed by other components or compromised locally.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This shared skill file exposes a generic `ai_chat` interface that is unrelated to the stated fruit-ripeness grading purpose, expanding the skill's capability beyond its declared function. Even though the subprocess invocation is currently commented out/broken, the presence of a latent agent-execution pathway in shared code increases attack surface and creates a straightforward path for future re-enablement or misuse by other skills.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code includes a generic external agent/LLM execution mechanism unjustified by the skill's stated functionality, which is a risky capability mismatch. In security terms, undeclared model/agent invocation can enable prompt exfiltration, policy bypass, or unexpected data flows if later activated, especially because this lives in common shared code and may be reused widely.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains network authentication, token handling, and remote account provisioning logic that is unrelated to fruit ripeness grading. In the stated skill context, silently contacting external services and creating or restoring accounts expands the trust boundary and can transmit identifiers, tokens, and usage metadata without user awareness.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads a workspace identity file and, if absent, creates and persists a default local identity for later reuse. For a fruit grading skill, this is context-inappropriate identity management behavior that can silently bind activity to a local or generated user identifier and create persistent state the user did not request.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The workspace discovery and automatic directory creation logic is broader than expected for a fruit ripeness grading skill and enables the code to inspect agent runtime layout and create persistent storage areas. While not inherently malicious, this increases filesystem reach and persistence capabilities beyond the apparent functional need of the skill.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The automatic trigger phrases for history retrieval are broad enough to match ordinary user requests, which can cause unintended invocation of cloud report-list APIs. In a skill that auto-associates identity and accesses account-linked history, overbroad triggering can expose historical records or metadata without sufficiently deliberate user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that uploaded attachments are automatically saved as local files, but it does not provide a clear user-facing disclosure of retention, location, lifecycle, or deletion. Automatic local persistence of user media increases privacy and data-handling risk, especially when files may later be uploaded to remote services or remain on disk after processing.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2