ClawHub
Back to skill

Security audit

Fruit Ripeness Grading | 番茄/草莓果实成熟度分级

Security checks across malware telemetry and agentic risk

Overview

The skill’s fruit analysis purpose is real, but it also silently creates or reuses an account, stores tokens locally, and sends media or URLs to a remote service with limited user control.

Install only if you are comfortable with a cloud-backed skill that uploads local media or submitted URLs, queries remote report history, creates or reuses a service identity, and stores account tokens in the workspace data directory. Avoid using sensitive images, private/internal URLs, or workspaces where local token persistence is unacceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, yet its documented behavior includes shell execution, local file read/write, environment use, and network access. This undermines the trust boundary for users and reviewers, because the skill can persist data locally and transmit data remotely without an explicit permission contract.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as a visual fruit-ripeness grader, but its documented/observed behavior extends into remote history retrieval, local identity persistence, token/account handling, and report-link exposure. This mismatch can cause users to consent to simple image analysis while the skill performs broader data processing and remote account activity than expected.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The documentation expands the skill from local visual grading into cloud-hosted historical report retrieval and report-link generation. That broadens the data-access scope beyond what a user would reasonably infer from the skill title and increases privacy and data-exposure risk.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The file documents pet health analysis endpoints even though the skill is described as fruit ripeness grading. This mismatch is dangerous because it can cause the agent or integrators to call unrelated backend services, mishandle data, or expose capabilities and identifiers from a different domain than intended. The contradiction increases suspicion because it suggests copy-paste reuse or accidental cross-skill linkage rather than a purpose-built fruit analysis integration.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The inline documentation explicitly states that the file is for pet health analysis API docs, which directly contradicts the declared fruit-ripeness purpose of the skill. Such contradictory documentation can lead to unsafe integration, accidental invocation of unrelated APIs, and confusion about what data types the skill is allowed to process, increasing the risk of data leakage or unintended service access.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The skill metadata describes fruit ripeness grading from grow-box or mobile phone images, but the implementation accepts both local video files and arbitrary remote video URLs. This expands the skill's data-ingestion surface well beyond its declared purpose, increasing privacy, abuse, and unintended backend processing risks because users or upstream agents may submit sensitive or untrusted media that the service was not expected to handle.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code accepts arbitrary http/https URLs and forwards them as videoUrl for analysis without hostname restrictions, allowlisting, or any user-safety controls. In agent settings, this can enable unintended network reach-through by proxying external fetches through backend services, creating SSRF-like risk, privacy issues, or analysis of attacker-controlled content outside the skill's stated local image-analysis use case.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation materially diverges from the declared skill purpose: the manifest says fruit-image ripeness grading, but the code exposes generic video analysis and history-listing behavior. This kind of capability mismatch is dangerous because users and reviewers may grant image-analysis permissions or trust assumptions while the skill actually processes different media and performs undeclared remote operations, enabling deceptive data collection or unauthorized functionality.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The CLI advertises itself as a 'video analysis tool', which directly contradicts the fruit-ripeness grading description presented to users. Misleading interface text increases the chance of deceptive use and consent failure, because operators may not realize they are invoking a different capability than the installed skill claims to provide.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file exposes a broad generic network/CRUD wrapper surface (`add`, `edit`, `delete`, `http_post`, `http_put`, `http_get`, `http_delete`) that is far wider than the declared fruit-ripeness analysis purpose. In an agent-skill context, this unnecessary capability expansion increases the attack surface and could let the skill be repurposed to access or modify arbitrary backend resources if untrusted inputs can influence URLs or request payloads.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The `get_user_by_username` capability enables user-account lookup that is not justified by the stated fruit-ripeness grading workflow. Even if intended for convenience, this creates an unnecessary identity/data-access primitive that could facilitate account enumeration or retrieval of user information unrelated to the skill's agricultural function.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
A fruit ripeness analysis skill should not need generic user-account persistence logic, yet this module defines a reusable user table and DAO that can store identities and account-like records. In this context, the mismatch increases suspicion because it broadens the data surface and creates unnecessary capability for collecting or persisting user information unrelated to the advertised function.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores authentication-like tokens (token, open_token) along with personal profile fields such as realname, email, birthday, sex, and age, none of which are necessary for fruit ripeness grading. In this skill context, collecting and persisting such data materially increases privacy and credential exposure risk, especially because the tokens appear to be stored directly in a local SQLite database without evident encryption, minimization, or access controls.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs broad identity bootstrap, token management, local persistence, and arbitrary outbound HTTP requests that are not justified by a fruit-ripeness grading skill. This creates an overprivileged shared component that can transmit workspace-linked identity and authentication state to external services, expanding the attack surface far beyond the declared functionality.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code silently logs in or auto-registers users by sending openId/mobile/source data to a backend service, despite the skill being presented as image-based produce grading. Hidden account creation and login behavior can bind the user's environment to remote services, create unauthorized identities, and enable downstream token issuance without informed consent.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This code reads identity state from the workspace, generates fallback user identifiers, stores them locally, and updates global current-user state unrelated to fruit-image grading. That behavior can persist identities across runs and agents, making later network requests silently attributable to a user and increasing privacy and account-coupling risk.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The historical-report trigger phrases are broad enough that normal conversation about reports or harvest records may automatically invoke a cloud lookup. That can cause unintended remote data access and disclosure of historical records without sufficiently specific user authorization.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that uploaded attachments are automatically saved as local files, but this persistence is not clearly disclosed in the user-facing description. Silent local retention increases privacy risk, especially for image/video uploads that may contain metadata or sensitive background content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill accepts user-supplied network URLs and forwards them to an API service for remote fetching without a clear privacy or data-transfer warning. This can expose user-provided URLs and referenced content to third-party infrastructure and may enable unexpected access patterns or sensitive URL leakage.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script silently resolves an internal user identity via OpenIdUtil.resolve_current_open_id() without clear disclosure or consent, even though the corresponding parameter is hidden from help output. Hidden identity binding can cause analysis actions or listing operations to run under an internal account context, creating privacy, authorization, and auditability risks if users do not understand which identity is being used.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script accepts a hidden API credential parameter that is intentionally suppressed from help output, reducing transparency around authentication and remote service usage. Hidden credential handling can cause unsafe operator behavior, accidental secret exposure in automation, and makes it harder for users to understand where data is going and under what trust model.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The analysis flow passes a local input path or remote URL into a backend analysis routine without clear disclosure that processing may occur remotely. In the context of an agricultural imaging skill, this creates privacy and data-governance risk because users may believe analysis is local while farm, greenhouse, or device media is actually transmitted to external services.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill reads a workspace file containing API-key-related identity data without any visible disclosure or consent flow. In the context of an innocuous fruit analysis tool, silently harvesting identity material from the local workspace is unexpected and materially increases privacy and misuse risk.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The code sends user identity and registration-related data to a remote service without user-facing warning. Because the skill's advertised purpose is fruit ripeness grading, this undisclosed transmission is contextually suspicious and violates user expectations around local image analysis.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
93% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2