ClawHub
Back to skill

Security audit

Crop Yield Prediction | 经济作物产量预测

Security checks for vulnerabilities and agentic risk

Overview

This crop-yield skill uses cloud media analysis, but it silently handles identity, stores reusable tokens, and ships development HTTP endpoints that can expose user media and account data.

Review this skill carefully before installing. It sends media or media URLs to a remote service, automatically creates or reuses an internal identity, retrieves identity-linked history, and stores reusable service tokens locally. It should not be used with sensitive farm, location, business, or account data until the publisher ships HTTPS production endpoints by default and adds explicit controls for identity, token retention, history access, and local media storage.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
skills/smyx_common/scripts/config-dev.yaml:2
Finding

Sensitive identifiers, authentication tokens, and crop media are transmitted over plaintext HTTP

Content
View full analysis

Vulnerability Details

File Locations:

  • skills/smyx_common/scripts/config.yaml:4-6,15
  • skills/smyx_common/scripts/config-dev.yaml:1-7
  • skills/smyx_common/scripts/util.py:551-561,612-646
  • skills/smyx_analysis/scripts/skill.py:113-130

Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: High

Vulnerable Code

The distributed configuration enables the development environment:

yaml
ApiEnum:
  api-key: null
  api-secret-key: null
  base-url-health: https://lifeemergence.com/jeecg-boot-xzgz
  base-url-open-api: https://open.lifeemergence.com/smyx-open-api
  base-url-open-h5: http://livemonitor.lifeemergence.com
  database-url: null
ConstantEnum:
  app--id: x1a3s4nwy1s2r4se
  current--tentant-code: XIAN_ZHAO_GAN_ZHI
  default--skill-platform-name: ARK_CLAW
  feishu-app--id: cli_a93d769369badcb1
  feishu-app--secret: null
  is-debug: false
env: dev

The development profile replaces the HTTPS service endpoints with plaintext HTTP endpoints:

yaml
ApiEnum:
  base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"
  base-url-open-h5: "http://192.168.1.234:4100"
  base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz"

ConstantEnum:
  is-debug: true

Identity registration sends the resolved internal identifier as both openId and mobile:

python
def _get_or_create_user(username):
    _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin"
    open_id = username
    _data = {
        "silent": 1,
        "register": 1,
        "openId": open_id,
        "mobile": username,
        "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
    }
    try:
        _response = requests.post(_url, json=_data)
        if _response.status_code == 200:
            _response_json = _response.json()
            if _response_json and _response_json.get("success"):
                return _response_json and _res
...[truncated 4621 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove env: dev from the distributed release configuration and use a production profile by default.
  2. Require https:// for all health, Open API, H5, analysis, polling, report, and authentication endpoints.
  3. Add startup validation that rejects plaintext HTTP endpoints outside an explicitly enabled local test mode.
  4. Do not silently downgrade to HTTP if HTTPS fails.
  5. Use standard certificate validation and a trusted certificate chain. If the deployment threat model warrants it, consider certificate pinning.
  6. Add an explicit timeout to the direct requests.post registration request.
  7. Avoid sending an internal identifier in a field named mobile unless the API contract strictly requires it. Separate pseudonymous account identifiers from phone-number fields.
  8. Clearly disclose that selected media, media URLs, identity metadata, and report queries are transmitted to a remote analysis service.
  9. Rotate tokens previously used through the plaintext development endpoints.
  10. Add automated tests and CI checks that reject release artifacts containing active HTTP service endpoints or env: dev.

T09 · Insecure Skill Coding Practices

Warning
Location
skills/smyx_common/scripts/util.py:586
Finding

Reusable authentication tokens are stored unencrypted in a shared SQLite database

Content
View full analysis

Vulnerability Details

File Locations:

  • skills/smyx_common/scripts/util.py:586-604
  • skills/smyx_common/scripts/dao.py:163-180
  • skills/smyx_common/scripts/dao.py:449-462

Vulnerability Type: Insecure storage of authentication credentials
Risk Level: Medium

Vulnerable Code

Tokens returned by the remote login operation are copied into the local user model and persisted:

python
if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN:
    new_current_user = _get_or_create_user(current__user_name)
    if new_current_user:
        ApiEnum.TOKEN = new_current_user.get("token")
        ApiEnum.OPEN_TOKEN = new_current_user.get("openToken")

        current_user_info = new_current_user.get("userInfo")
        if current_user_info:
            current_user_info["token"] = new_current_user.get("token")
            current_user_info["openToken"] = new_current_user.get(
                "openToken")
            user_model = User.load(current_user_info)

            user = user_dao.save(
                user_model
            )

The database is created as a shared workspace SQLite file without an encryption mechanism:

python
def __init__(self, db_path: str = None):
    """
    Initialize DAO.
    """

    if not db_path:
        db_path = "smyx-common-claw.db"

    db_path = self.get_db_path(db_path)

    self.engine = create_engine(f"sqlite:///{db_path}", echo=False)

    self.SessionLocal = sessionmaker(
        autocommit=False,
        autoflush=False,
        bind=self.engine
    )
    self._create_tables()
    self._alter_tables()

The credential values are ordinary plaintext database columns:

python
class User(Base, BaseModelMixin):
    """User model"""
    __tablename__ = "sys_user"

    id = Column(String(32), primary_key=True, index=True)
    source_id = Column(String(32), comment="source id")
    username = Column(String(100), un
...[truncated 3234 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store reusable tokens in an operating-system-backed secret manager rather than SQLite.
  2. If database persistence is unavoidable, encrypt tokens using authenticated encryption with a key stored outside the database and outside the shared workspace.
  3. Create the database and parent directory with owner-only permissions, such as 0700 for the directory and 0600 for the database on POSIX systems.
  4. Avoid sharing credential storage across unrelated Skills. Use per-Skill and, where applicable, per-user credential namespaces.
  5. Request short-lived, narrowly scoped tokens and implement secure refresh-token rotation.
  6. Do not persist tokens when the current operation does not require cross-session authentication.
  7. Revoke and rotate existing tokens after changing the storage design.
  8. Ensure backups, diagnostics, and support bundles exclude the credential database.
  9. Add explicit token deletion on logout, account reset, repeated authorization failure, and Skill removal.
  10. Document the credential retention period and provide users or administrators with a mechanism to remove locally stored identities and tokens.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (57)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is the strongest mismatch: the skill reportedly performs workspace discovery, local file access including API-key material, identity resolution/default open-id generation, local DB use, external HTTP authentication, token storage/retry, and possible remote login/account creation. Those are highly sensitive capabilities unrelated to a narrowly described crop-yield skill and materially increase the risk of secret exposure, unauthorized identity use, and backend account abuse.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "smyx-crop-yield-prediction-analysis"
description: "Predicts expected yield of economic crops such as tomato, corn and potato by combining growth stage, nutrition status, environmental data and historical yield references. | 结合生长阶段、营养状况、环境数据与历史产量数据，预测番茄/玉米/土豆等经济作物的预期产量。"
version: "1.0.9"
license: "MIT-0"
---

# 🌾 Crop Yield Prediction | 经济作物产量预测

> 结合生长阶段、营养状况、环境数据与历史产量数据，预测番茄/玉米/土豆等经济作物的预期产量。
>
> **智能产量预估中枢** · 图片/视频�

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill that predicts agricultural crop yield from growth, nutrition, environmental, and historical yield data. However, the code expects a local video path or network video URL, uploads a file as 'videoUrl' or binary file content, polls for an asynchronous analysis job, and formats/export report results, which is semantically unrelated to crop-yield prediction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The implementation performs video analysis and video history listing despite the manifest claiming crop-yield prediction. This kind of functionality mismatch is dangerous because it can conceal undeclared data processing and remote interactions under an innocuous agricultural description, defeating user trust, review expectations, and permission scoping.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline documentation and CLI strings repeatedly identify the tool as a video-analysis utility, directly contradicting the published crop-yield purpose. In context, this strengthens evidence of deceptive packaging: a user or platform may invoke the skill expecting agronomic analysis while actually sending media inputs or querying media history APIs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The helper reads an identity value from a local workspace file and, if absent, creates a default local user identity automatically. This is dangerous because it silently binds requests to a discovered or generated identity without informed user action, creating privacy, attribution, and unauthorized-access risks unrelated to the advertised crop analysis purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The utility code performs implicit account lookup, auto-registration/login, token acquisition, and persistence of user records/tokens in local storage, which is unrelated to crop-yield prediction. In a skill context, this expands privileges and creates undisclosed identity/network side effects, enabling unauthorized account creation or silent use of a local identity during ordinary skill execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises and instructs use of shell, filesystem, environment, and network-capable scripts but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent executes broader capabilities than intended, including local file access and remote API interaction, without least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The history-report trigger phrases are broad enough that normal conversational requests may unintentionally invoke cloud history retrieval. In this skill context, that is riskier because history retrieval is identity-linked and may expose prior report metadata without a clear, deliberate user action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill states uploaded media will be automatically saved locally, but it does not provide a clear user-facing warning or retention policy. Since images/videos may contain sensitive farm, location, or operational data, silent local persistence increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises crop-yield prediction, but its core function and CLI still expose pet-analysis semantics such as pet_type, analyze_video, and pet-specific choices. This kind of capability/intent mismatch is dangerous because it can misroute user data to the wrong backend or model, produce misleading results, and hide what the code is actually doing from users and reviewers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The help text tells users they are performing crop-yield prediction, while the actual parameter design and internal function naming suggest pet/video analysis behavior. This discrepancy can mislead operators about what data is being processed and what service is being invoked, undermining informed consent, auditability, and trust in the tool's output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The argparse description, help text, status output, and error messages are all hard-coded in Chinese across the CLI flow. This creates a natural-language policy concern because the skill enforces a specific language without any user opt-in, fallback, or documented justification that the tool is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2