Crop Fruit Ripeness Grading | 经济作物果实成熟度分级

• Outcome: Review
• Latest audit: Oct 15, 2026 · 2:31 AM UTC
• Version: 1.0.14

Overview

The skill is mostly a disclosed cloud media-analysis tool, but it automatically creates/reuses identity state and stores service tokens while shipping mismatched generic/pet-analysis code that users should review before installing.

Install only if you are comfortable with images or videos being sent to the configured cloud service and with the skill creating/reusing a local identity that can persist tokens in the workspace data directory. Review or clear the generated data database if you do not want account-linked report history retained locally, and treat history-report requests as cloud account queries rather than purely local summaries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrow fruit-ripeness grading, but the surrounding behavior indicates generic remote API invocation, identity resolution, historical record retrieval, persistence, and unrelated parameterization. This mismatch is dangerous because users and platform reviewers may trust the skill with crop images while it actually supports broader data collection and backend-driven operations that are not obvious from the description.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-crop-fruit-ripeness-grading-analysis"
description: "Identifies fruit ripeness stages (green / turning / ripe / over-ripe) based on color, size and gloss features to output a standardized ripeness grade. | 通过颜色、大小、光泽度识别果实成熟度（青/转色/成熟/过熟），输出成熟度等级。"
version: "1.0.16"
license: "MIT-0"
---

# 🍅 Crop Fruit Ripeness Grading | 经济作物果实成熟度分级

> 通过颜色、大小、光泽度识别果实成熟度（青/转色/成熟/过熟），输出成熟度等级。
>
> **智能采收决策中枢** · 图片/视频智能分析 · 成熟度分级 · 历史报�

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Contradictory help text and comments indicate the implementation does not match the claimed skill purpose. In a security context, such inconsistencies are a red flag for repurposed or mislabeled code, making it harder to review and increasing the chance that hidden or unrelated functionality is shipped under an innocuous description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI advertises a fruit ripeness grading tool, but the exposed arguments and help text reference pet health analysis and pet types instead. This mismatch is dangerous because it indicates the skill may be copied from an unrelated capability and could invoke unintended backend behavior or collect/process data outside the declared purpose, violating least privilege and user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation behavior materially contradicts the skill manifest: it performs generic video analysis and exposes history-listing functionality rather than fruit ripeness grading. This kind of capability mismatch is dangerous because it can mislead users about what data is processed and where it is sent, enabling undisclosed collection or off-purpose use of uploaded media.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file exposes a generic service layer for arbitrary remote operations: broad CRUD helpers plus unrestricted http_get/http_post/http_put/http_delete methods that can call caller-supplied URLs. That capability is far wider than the declared fruit-ripeness function and creates a powerful exfiltration/pivot surface if the skill or downstream code is influenced by untrusted input; the skill context makes this more suspicious because the networking features are unrelated to image/feature grading.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores usernames, real names, email, token, and open_token, which are sensitive identity and credential-like values unrelated to fruit ripeness analysis. In this skill context that is especially dangerous because collecting and persisting authentication or identity material is unjustified, increasing the likelihood of privacy violations, credential exposure, and covert tracking.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility module contains account bootstrap, token handling, identity persistence, and authenticated remote API behavior that is unrelated to fruit ripeness grading. In the context of a simple analysis skill, this creates unnecessary capability for remote account manipulation and data transmission, greatly expanding the attack surface and enabling covert service interaction under the user's environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code reads identity data from workspace files and can create or persist default user identities locally, despite the skill's declared purpose being fruit ripeness grading. This mismatch is dangerous because it silently binds user or workspace identity into backend-facing operations and establishes durable tracking state without necessity for the advertised task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The generic HTTP client accepts arbitrary URLs or appends relative paths to a base URL, injects tokens and identity headers, and can trigger auto-login/registration flows. For a fruit-grading skill, this is unjustified and dangerous because it enables outbound communications and credential-bearing requests unrelated to the task, potentially exposing identity, tokens, and workspace-linked accounts to remote systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises extensive capabilities—shell execution, network access, filesystem access, environment access, and local file writes—without declaring an explicit tool scope or permissions boundary. This weakens reviewability and increases the chance that a benign-looking image-analysis skill can perform broader side effects such as uploading data, persisting files, or invoking local commands beyond user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames the skill as ripeness grading only, but the documentation adds cloud-based historical report retrieval and report-link generation. Hidden secondary functions increase privacy and data-governance risk because a user invoking a simple classifier may unknowingly trigger access to prior account-linked records.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The history-report trigger phrases are broad enough that ordinary user language could unintentionally activate cloud history retrieval. In a skill that also auto-associates an internal identity, this raises the chance of inadvertent disclosure of prior account-linked reports or metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that uploaded attachments are automatically saved as local files, but this persistence behavior is not clearly surfaced as a user warning in the primary description. Silent local storage increases privacy and retention risk, especially for media that may contain incidental sensitive information, and can expand the attack surface through leftover files.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2