Back to skill

Security audit

Flowering & Fruit Set Rate Analysis | 番茄/辣椒开花坐果率分析

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform cloud-based plant media analysis, but it also silently creates or reuses a local identity and stores account tokens, so it should be reviewed before installation.

Install only if you are comfortable with this skill sending plant images or videos and report queries to the configured LifeEmergence cloud service, creating or reusing a local user identity, and storing authentication tokens in a workspace SQLite database. Review and restrict its workspace data access if possible, and avoid using it in shared environments unless account separation and token cleanup are clear.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill advertises only benign plant-image analysis, yet its documented and detected capabilities include shell execution, network access, file read/write, and environment access without any declared permission boundary. This creates a significant trust gap: a host may grant broader runtime powers than users expect, enabling data exfiltration, local persistence, or unreviewed command execution through the bundled scripts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a true security-relevant mismatch: the skill claims to count flowers and fruit set, but it also performs identity provisioning, local persistence, remote authentication, and history retrieval from cloud services. Such hidden behavior expands the attack surface and can mislead operators into authorizing a skill for simple image analysis when it is actually handling identity state and communicating with external systems.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill manifest centers on local image/video analysis, but the documentation elevates cloud history-query and report-link retrieval into core behavior. This is dangerous because it silently changes the data handling model from isolated analysis to ongoing remote record access, which may expose prior user data or create unintended cross-session access patterns.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Automatic internal identity initialization, fallback to a default local user, and reuse across tasks are not necessary for straightforward plant image analysis and introduce persistent account-linkage risk. In practice, this can cause one user's reports or tokens to be associated with another session or local profile, undermining isolation and privacy.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The API documentation is clearly inconsistent with the declared skill purpose: it documents pet health analysis endpoints and scene codes for a tomato/chili flowering and fruit-set skill. This kind of cross-domain mismatch is dangerous because it can cause the agent to call unintended backend services, expose unrelated data, or route user inputs into the wrong business workflow, especially if the same API key and shared base URL infrastructure are used.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The CLI presents this skill as a tomato/chili flowering analysis tool, but it exposes pet-oriented parameters and list functionality that do not match the declared purpose. This kind of scope mismatch is dangerous because it can hide unrelated capabilities from users and reviewers, undermining informed consent and making it easier to ship undeclared data handling behavior.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill includes a user-specific analysis history retrieval path via `show_analyze_list(open_id)` even though the declared function is one-off flower/fruit-set image analysis. Undeclared history access expands the data exposure surface and could enable users' prior analysis records to be enumerated or disclosed without clear authorization boundaries.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code initializes an internal identity mechanism with `OpenIdUtil.resolve_current_open_id(...)` despite the skill's stated purpose not requiring user identity to analyze local or remote plant images. Introducing hidden identity resolution creates unnecessary collection or linkage of user data and increases the risk of privacy violations or unauthorized association of analyses with a persistent identifier.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The implementation accepts remote video URLs and local video files even though the skill is described as analyzing still images of plant flower/fruit clusters. This scope mismatch can expose users to unexpected data handling, larger uploads, and backend processing paths not covered by the stated purpose, increasing the chance of privacy issues or misuse of the analysis endpoint.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The implementation behavior materially diverges from the advertised plant flowering/fruit-set image analysis and instead performs generic video analysis and history listing. This is dangerous because users may provide unrelated or more sensitive media under false expectations, and the mismatch can hide undeclared capabilities or backend processing not aligned with the skill’s stated purpose.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The user-facing help text and documentation present the tool as a generic video analyzer, contradicting the declared agricultural image-analysis purpose. Misleading interfaces are security-relevant because they defeat informed consent, obscure what data is being processed, and can cause operators to use the skill in unintended ways that expose additional content or metadata.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This file exposes a broad API wrapper layer with generic paging, CRUD, and arbitrary HTTP helpers that are not constrained to the skill’s declared purpose of flowering/fruit-set image analysis. In an agent-skill context, this unnecessarily expands the skill’s capabilities to interact with unrelated backend resources, increasing the risk of unauthorized data access, unintended side effects, or misuse if higher-level inputs are attacker-controlled.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The add, edit, and delete methods provide direct record-modification capabilities even though the stated skill only needs to analyze plant images and compute fruit-set rates. If reachable from agent logic or user-influenced inputs, these methods could be abused to alter or delete backend data unrelated to the advertised function.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The generic HTTP helper methods accept arbitrary URLs and arguments, giving the skill broad outbound network/request capability beyond what is needed for fruit-set analysis. In a plugin or agent environment, this can enable unintended access to internal APIs, exfiltration paths, or misuse of trusted request context if an attacker can influence the destination or parameters.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
User account lookup by username is unrelated to the skill’s declared plant image analysis purpose and introduces an unnecessary identity/data-access capability. Even if harmless in isolation, it broadens the attack surface and may facilitate user enumeration or access to account-associated information when combined with other components.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The skill is described as plant image flowering/fruit-set analysis, but this file implements persistent user-account storage and mutation operations unrelated to that purpose. That mismatch expands the data-handling surface unnecessarily and creates privacy and abuse risk because the skill can retain and alter user identity records despite no clear functional need.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The code silently creates and alters a local SQLite schema even though the manifest presents the skill as analytics-only image processing. Undisclosed persistent storage is dangerous because it changes the trust model, can retain user-related data across runs, and may surprise operators who did not consent to local stateful behavior.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model includes token and open_token fields, enabling storage of authentication or API credentials in a skill whose stated purpose is plant image analysis. This is especially risky because unnecessary credential collection increases the blast radius of compromise and invites misuse unrelated to the skill's declared function.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill exposes a generic `ai_chat` / agent-execution capability that is unrelated to the stated flowering and fruit-set image-analysis purpose. Even though the subprocess body is currently commented out, embedding a general agent bridge inside a domain-specific skill expands the attack surface and creates a latent path for prompt-driven misuse, privilege creep, or future unsafe command execution when the placeholder is completed.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility layer performs remote account provisioning, token retrieval, token caching, and authenticated API setup that are unrelated to tomato/chili flower and fruit-set image analysis. In the context of a narrowly scoped agronomic vision skill, hidden identity bootstrap and network-auth behavior materially expands the attack surface and can cause silent data transmission and account creation without informed user intent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code reads a local API-key-derived identity, searches a local database for reusable users, and creates a persistent default open-id when none exists. For an image-analysis skill, persistent identity creation and reuse are unnecessary to the stated function and create privacy and tracking risk across sessions or workspaces.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workspace-discovery code inspects environment variables, parses filesystem layout, walks parent directories, and creates data/skills directories. While not overtly malicious, this capability is broader than needed for flower/fruit-set analysis and increases the skill's ability to map and modify the local agent workspace, which is risky in an overprivileged shared utility module.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The default trigger is broad enough to auto-invoke on general flower/fruit vegetable imagery, including related crops beyond the named use case. Overbroad activation is risky because it can unexpectedly process attachments, save files, or send data to backend services when the user did not specifically request this skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2