Cutting Rooting Status Detection (Transparent Container) | 扦插枝条生根状态（透明容器）

• Outcome: Review
• Latest audit: Aug 26, 2026 · 5:42 AM UTC
• Version: 1.0.9

Overview

The skill can upload plant images or videos for cloud analysis, but it also silently creates or reuses account identity and stores tokens locally, so it needs review before installation.

Install only if you are comfortable with cloud processing of uploaded media, automatic account-scoped history lookup, and local storage of identity/token data. Prefer a revision that clearly documents endpoints, retention, identity handling, permissions, and provides explicit opt-in or cleanup controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires shell execution, network access, local file reads/writes, and likely environment access. This undermines least-privilege controls and prevents users or the hosting platform from making an informed trust decision before the skill runs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to perform narrow plant-rooting visual analysis, but its documented/observed behavior includes hidden account handling, local user creation, token persistence, cloud history retrieval, and generic remote AI processing. This description-behavior mismatch is dangerous because it conceals data flows and privileged operations that users would not reasonably expect from a simple image-analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill expands from image-based rooting assessment into cloud-hosted historical report retrieval and direct report-link generation, introducing additional remote data exposure and account-scoped access paths. That broader scope increases privacy and access-control risk, especially because users may not expect prior records to be queried from a remote service.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatic internal identity association and fallback local-user creation are unrelated to the core plant-analysis task and create hidden identity state on the device or platform. This can silently bind user activity to stored accounts, enable unintended cross-session access to reports, and obscure how authentication and authorization are being handled.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The file documents pet health analysis endpoints even though the skill is supposed to perform plant cutting rooting-stage detection. This cross-domain mismatch is dangerous because it can cause the agent or integrator to call unrelated APIs, route plant images or metadata into a pet-health workflow, and expose or misuse data through an unintended backend. The contradiction also suggests the skill may be mispackaged, stale, or contaminated with copied documentation, which increases the risk of hidden functionality or deployment mistakes.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation accepts local files or remote video URLs and forwards them to a generic analysis backend, which materially differs from the manifest’s claimed image-based rooting-stage detection behavior. This kind of skill/manifest mismatch is dangerous because users may grant access or trust outputs under false assumptions, enabling undisclosed data handling and broader collection than expected.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The output layer presents only a generic 'analysis report' and export link rather than the specific rooting-stage results promised by the skill description. This weakens transparency and can conceal the true nature of backend processing, making it harder for users or reviewers to detect misuse or overbroad analysis.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The implementation materially diverges from the declared skill purpose: instead of narrowly performing plant cutting rooting-stage image analysis, it exposes a generic video-analysis entry point with local file and remote URL ingestion. This kind of scope mismatch is dangerous because it can conceal undisclosed data flows or broader media-processing behavior that users and reviewers would not expect from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The history-listing function retrieves prior analyses by open_id, which is unrelated to the stated task of rooting-stage detection and introduces an unexpected data-access capability. If access controls are weak elsewhere, this could expose prior user analysis records or metadata beyond the least-privilege expectations for this skill.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The CLI and docstrings repeatedly describe a generic video-analysis tool rather than a plant-rooting detector, reinforcing that the delivered functionality does not match the advertised capability. This inconsistency increases the risk of deceptive packaging, unsafe operator assumptions, and unreviewed processing of arbitrary media or remote content.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This file exposes a generic transport layer with broad CRUD and arbitrary HTTP wrappers (`http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the rooting-analysis use case. In an agent-skill context, such capability expansion increases the attack surface because other components can route arbitrary outbound requests or destructive remote operations through this helper, enabling unintended data access, exfiltration, or remote state changes if inputs are attacker-controlled.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This file implements generic user-account persistence and lookup logic that is unrelated to the declared plant-rooting analysis purpose. Capability overreach increases the attack surface, creates unnecessary retention of user data, and makes it easier for a skill in a narrow domain to collect or manipulate account information without clear justification.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores identity and authentication-related fields such as username, realname, email, token, and open_token, which are unrelated to rooting-stage detection. Collecting and persisting tokens in a local SQLite database materially raises the risk of credential leakage, unauthorized account reuse, and privacy violations if the workspace or database file is exposed.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This utility file implements broad remote API interaction, token handling, automatic login/registration, and account persistence that are not justified by a plant rooting-stage image-analysis skill. The mismatch between stated purpose and actual capabilities increases the risk of covert data transmission, hidden account creation, and privilege misuse through shared utility code that other skill paths can invoke.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads a workspace file (`data/smyx-api-key.txt`), derives an identity from it, searches local user records, and creates default identities when none exist. For a rooting-status detector, this is an unjustified identity-management capability that can silently bind activity to local or generated accounts without user awareness.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The agent-context and workspace-discovery logic enumerates runtime layout, inspects environment variables, and locates data/skills directories across agent workspaces. While not directly exploitative on its own, this exceeds the least-privilege needs of simple image classification and increases the blast radius for misuse of local files or cross-agent state.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation states that uploaded attachments are automatically saved as local files, but the skill description does not prominently warn users about this persistence behavior. Silent local retention increases privacy and data-handling risk, especially for photos/videos that may contain unintended sensitive background information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill triggers direct cloud API calls for history-report queries without a clear privacy disclosure in the main description. Users may believe they are interacting only with a local analysis tool, when in fact account-linked historical data is being fetched remotely.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script initializes and uses a hidden open-id flow for identity-scoped list retrieval while suppressing the parameter from normal help output, which reduces user visibility into how account context is selected. This can cause unintended access to another identity's analysis history or confusion about whose data is being queried, especially if the current environment or internal resolver supplies an unexpected open ID.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code reads arbitrary local file contents or accepts remote URLs and submits them for analysis without any user-facing warning, consent flow, or disclosure in this file. In a skill framed as plant-root monitoring, silent upload of media increases privacy and data-governance risk, especially if users believe processing is narrow or local.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When debug mode is enabled, the code turns on low-level HTTP connection debugging and verbose urllib3 logging, which can expose request URLs, headers, tokens, and response contents in logs. Because this happens centrally in shared utilities and without user-facing disclosure, sensitive operational and identity data may be leaked during normal troubleshooting.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The function silently reads an identity value from a workspace file and uses it as part of the current user/open-id resolution path without any user notification. This is dangerous because it creates an undisclosed identity binding and can cause downstream authenticated requests under a locally sourced identity the user did not knowingly select.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `_get_or_create_user` flow automatically sends identity fields (`openId`, `mobile`, `source`) to a remote `/sys/phoneLogin` endpoint with `register=1`, effectively creating or logging into an account without clear user awareness. In the context of a plant-analysis skill, this hidden identity transmission is especially suspicious and enables undisclosed external tracking and account creation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The central request wrapper attaches tokens, API keys, tenant and platform metadata, and inferred usernames to outbound requests automatically. Because it is generic shared code and lacks explicit user disclosure or fine-grained scoping, it can silently transmit identity-bearing data far beyond what a rooting-stage detector appears to require.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This line performs external transmission of identity-related data to a remote service as part of an implicit get-or-create-user workflow. In a skill whose described purpose is local/non-invasive plant root-stage detection, undisclosed outbound identity transmission is a significant behavioral mismatch and creates privacy, tracking, and account-abuse risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2