Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a cloud-based plant image analyzer, but it silently creates or reuses account identities and stores authentication tokens while carrying unrelated pet/generic analysis artifacts.
Review this skill carefully before installing. It sends media or URLs to lifeemergence.com services and can retrieve cloud history, while also silently creating or reusing a local account identity and storing tokens in a workspace SQLite database. Install only if that account-linked cloud processing and local credential persistence are acceptable, and prefer a version with cleaned-up plant-only docs/CLI and explicit privacy controls.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Authentication/token management, user lookup/creation, filesystem inspection, and generic utilities point to a much broader system integration than the claimed root-image classifier. In the context of a benign agriculture skill, this undisclosed breadth is more dangerous because operators are less likely to expect account-linked storage and remote service interactions.
Metadata-poisoning indicators in a skill manifest are concerning because manifest fields strongly influence routing, trust, and tool selection in agent systems. While the specific match here is weak, any attempt to manipulate tool metadata or embed misleading descriptors can help conceal broader capabilities or alter how the skill is invoked.
---
name: "smyx-cutting-rooting-status-detection-analysis"
description: "AI-powered non-invasive rooting-stage detection for plant cuttings in transparent containers. From smart propagation boxes or transparent cutting containers, periodically captures images of the cutting base (water roots or substrate roots visible through the transparent wall), uses AI vision to detect white root primordia (tiny white callus dots) and count/locate them, and outputs the rooting stage (No Roots / Few Primordia / Many Primordia / Well-Developed Roots). Helps propagators monitor cutting-rooting progress without disturbing the cutting and choose the optimal transplant
The file documents pet health analysis APIs inside a skill whose stated purpose is plant cutting rooting-stage detection. This mismatch can cause the agent or integrators to invoke unrelated endpoints, expose or process unintended pet-health data, and indicates possible cross-skill asset reuse or packaging contamination that undermines trust boundaries.
The implementation materially diverges from the declared skill purpose: instead of a narrowly scoped plant-rooting image analysis workflow, it exposes a generic video-analysis entrypoint that forwards arbitrary local paths or URLs to a backend skill method. This kind of scope mismatch is dangerous because it can hide broader data-processing behavior than users and reviewers expect, undermining trust boundaries and potentially enabling unintended collection or transmission of non-plant media.
The code and CLI present themselves as a generic video-analysis tool, which directly contradicts the manifest's specialized image-based plant-rooting detector description. This deception-by-mismatch is risky because operators may grant access, route data, or approve deployment under false assumptions about what the skill actually processes, enabling misuse of media inputs or hidden backend capabilities.
The User model stores usernames, real names, email addresses, and token/open_token values even though the stated skill function is non-invasive plant rooting analysis. Persisting identity and authentication-related data without a clear functional need is dangerous because compromise of the local SQLite file would expose both personal data and potentially reusable bearer secrets.
The code reads identity material from local storage, persists user identity state, and auto-creates default users when no identity is present. For a plant-rooting analysis skill, this is unjustified privileged behavior that can silently establish or reuse identities and cause unintended account linkage, tracking, or backend access without meaningful user awareness.
The skill declares no explicit tool scope or permissions despite behavior indicating shell, filesystem, environment, and network access. This weakens the trust boundary for users and orchestration systems, because a seemingly simple vision skill can invoke much broader capabilities than its manifest discloses.
Overly broad natural-language triggers for history retrieval can activate cloud-backed account/report access on vague user requests. This can cause unintended disclosure of prior analysis records or unnecessary remote calls, especially when the trigger phrases overlap with common conversational requests.
The skill does not clearly warn users that analyzing remote URLs and querying history involves cloud transmission and backend account-linked processing. Lack of transparent disclosure undermines informed consent and can expose sensitive images, videos, or report metadata to remote services unexpectedly.
The core analysis function accepts pet_type and writes it into ConstantEnum.DEFAULT__PET_TYPE, and the CLI exposes cat, dog, and other choices. A plant cutting rooting-stage detector has no stated need for pet-type selection, so this behavior does not align with the manifest's described functionality.
The manifest says this skill analyzes rooting stages of plant cuttings in transparent containers, but the CLI options and help text describe a pet category (cat, dog, other) and a 'pet health analysis list'. This is not just incomplete documentation; it actively contradicts the stated plant-rooting purpose and indicates reused intent from a different skill.
The code initializes an internal user identity via OpenIdUtil.resolve_current_open_id using a hidden CLI argument and explicitly notes that users are not asked for this input and it is not shown in help. Hidden identity resolution without clear disclosure can cause analysis requests and list retrieval to run under an unexpected account context, exposing prior results or associating actions with the wrong user.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Detected: suspicious.install_untrusted_source