Greenhouse Climate Plant Feedback Analysis | 温室环境与植物状态联动调控

• Outcome: Review
• Latest audit: Aug 8, 2026 · 8:34 PM UTC
• Version: 1.0.6

Overview

The skill’s greenhouse analysis behavior is mostly disclosed, but it also performs under-disclosed identity creation, external login/registration, and local token persistence.

Review before installing. Expect greenhouse images or videos and history lookups to be sent to lifeemergence/open.lifeemergence services, and be aware the skill may create a local user record, register/login silently with the service, and keep auth tokens in the workspace data database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises no explicit permissions while its documented behavior requires shell execution, local file read/write, environment access, and network communication. This mismatch weakens user and platform trust boundaries because reviewers cannot accurately assess what the skill may do before activation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is greenhouse image/sensor analysis and control recommendation, but the implementation reportedly also performs unrelated account persistence, phone-login/token handling, and generic cloud report retrieval while lacking the claimed sensor/control functionality. This type of description-behavior mismatch can hide risky data flows and cause operators to trust a tool for one purpose while it performs materially different networked identity and storage operations.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documentation mandates running a local Python module to query cloud history, which introduces code-execution and network behavior beyond simple greenhouse analysis. In agent environments, instructing automatic shell/module execution increases the attack surface because local scripts may access files, secrets, or external services under the agent's privileges.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest describes plant analysis and climate-control output, but the documentation adds cloud-based history querying and report-link retrieval not clearly represented in the primary purpose. Hidden or secondary network features can expose user data and expand operational risk without informed consent.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The skill is presented as a greenhouse climate-control analyzer, but it delegates to generic pet-analysis and listing interfaces. In an automation context, this semantic mismatch can cause the wrong model, wrong data handling, or incorrect control outputs to be trusted and acted on, which is dangerous when outputs may drive irrigation, heating, or ventilation decisions.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The CLI claims greenhouse plant/climate-control behavior while exposing a pet-type parameter and pet-oriented defaults. This creates a deceptive operator interface and increases the chance of misconfiguration or silent routing into an unrelated inference path, undermining safety in a system that could influence physical actuators.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS video URLs even though the skill description centers on fixed greenhouse cameras. This broadens the trust boundary, enabling analysis of attacker-controlled remote content and potentially causing privacy, policy, or downstream processing risks if the backend fetches untrusted URLs.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation materially diverges from the declared greenhouse-control purpose: instead of fixed-camera plant/sensor fusion and climate-control logic, it exposes a generic video-analysis and history-listing CLI. This kind of scope mismatch is dangerous because it can conceal undeclared data flows or capabilities behind a benign manifest, undermining review, consent, and least-privilege expectations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Accepting arbitrary remote video URLs broadens the trust boundary beyond the manifest's fixed-camera greenhouse feeds. Even though this file does not itself fetch the URL, passing attacker-controlled URLs to downstream analysis services can enable unauthorized external content ingestion, SSRF-like behavior in backend components, or analysis of non-greenhouse material outside the approved use case.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The history-listing feature exposes a capability not justified by the stated real-time analysis/control purpose. Undeclared access to prior analyses can increase privacy and data-retention risk, especially if historical results contain imagery, identifiers, operational metadata, or sensitive greenhouse activity information.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The CLI presents itself as a generic video-analysis tool, which conflicts with the manifest's specialized greenhouse sensor-fusion and climate-control role. Misleading documentation and interface design can cause operators and reviewers to grant trust, data access, or deployment approval under false assumptions about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The method exposes a generic user-account lookup capability in a shared API service that is unrelated to greenhouse climate control or plant feedback analysis. Even though this snippet does not itself show authentication bypass, embedding identity-oriented lookup functionality in an unrelated skill expands the attack surface and can enable user enumeration, privacy leakage, or misuse by downstream components if access controls are weak.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The config initializer reads messaging/user identity environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) that are unrelated to greenhouse climate control. In a shared runtime, this creates unnecessary access to cross-skill identity data and can silently couple this skill to external platform context, increasing the risk of privacy leakage or confused-deputy behavior if those values are later logged, transmitted, or used for authorization decisions.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file contains a full generic user-account DAO in a skill whose declared purpose is greenhouse plant and climate feedback analysis. Unrelated identity/account-management code expands the attack surface, creates opportunities for unauthorized data handling, and suggests scope creep inconsistent with least privilege. In an operational greenhouse system, unnecessary account logic is more dangerous because it may coexist with actuator-control functionality in the same deployment.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores identity and authentication-related fields such as username, email, token, and open_token, yet the skill's stated greenhouse purpose does not justify collecting or persisting such data. Storing tokens in a local SQLite database materially increases the risk of credential theft, lateral movement, and privacy exposure if the host or workspace is compromised. Because this skill may run in environments that also issue control commands to irrigation, fans, and heaters, compromise of token-bearing local storage can have operational consequences beyond simple data leakage.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The utility code creates, resolves, and persists platform user identities and reads identity material from local files and a database, which is unrelated to the stated greenhouse plant-feedback function. This introduces hidden identity management behavior that can impersonate users, create undeclared accounts, and bind greenhouse actions to opaque external identities without informed consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The HTTP helper can silently call an external /sys/phoneLogin endpoint with register=1 and silent=1, effectively auto-registering or logging in users against a health-platform API. That behavior exceeds the greenhouse-control scope and creates undisclosed external account linkage and data transmission risks.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: An overly broad default trigger can cause the skill to activate for generic greenhouse image/video requests, leading to unintended file handling, network API use, or shell-script invocation. In an agent setting, accidental invocation is a meaningful security issue because privileged behaviors may occur without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that uploaded attachments are automatically saved as local files without a prominent warning. Automatic persistence can create privacy and security issues by storing potentially sensitive user media on disk without clear consent, retention rules, or isolation guarantees.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill omits a clear warning that it automatically queries a cloud API for historical reports. Silent external queries can transmit identifiers, metadata, or usage context off-platform, which is especially sensitive given the documentation's internal identity-handling behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code reads the entire local file and uploads it for analysis without any visible disclosure, confirmation, or minimization in this file. In a greenhouse setting, uploaded video may contain sensitive operational imagery, staff activity, or proprietary crop data, so silent transfer to a backend service creates privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: Accessing sensitive identity-related environment variables without clear disclosure or narrowly scoped need reduces transparency and can expose users or operators to hidden data collection. In this greenhouse context, the mismatch between purpose and accessed data makes the behavior more suspicious because plant-analysis logic should not require messaging-platform user identifiers.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code automatically creates a workspace data directory on disk without disclosure or consent. In isolation this is modest risk, but in combination with identity persistence elsewhere in the file it enables silent local storage of account-related data.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The utility creates a skills directory automatically, modifying the local workspace without a user-facing warning. While not intrinsically severe, silent filesystem mutation is outside the narrow greenhouse-analysis purpose and can be used to stage further persistence or package installation behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code reads an internal identity value from data/smyx-api-key.txt without disclosure, then uses it as an open-id fallback. This is dangerous because it silently binds requests to locally stored identity material and can leak or misuse credentials across unrelated skill executions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2