Security audit

Indoor Plant Light Stress Detection | 室内植物光照不足/过强识别

Security checks for vulnerabilities and agentic risk

Overview

The skill’s plant-image analysis purpose is coherent, but it uploads user files or URLs to a cloud service and silently creates or reuses identity/session state with too little user control.

Install only if you are comfortable sending selected plant images, videos, or submitted URLs to the configured lifeemergence.com cloud services and with the skill creating/reusing local and remote identity state. Avoid giving it private/internal URLs or sensitive media, and review the workspace data directory for stored identity/token data if you use it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "smyx-indoor-plant-light-stress-detect-analysis" description: "AI-powered indoor plant light stress detection from smart planter or fixed camera images (optionally combined with light sensor lux data). Detects morphological anomalies caused by low light (elongated internodes / etiolation, thin leaves, pale green color) or strong-light damage (leaf burn spots, scorched edges, curling, bleaching). Combined with optional lux sensor readings, it determines the current light stress type (insufficient / excessive / normal) and outputs adjustment suggestions (e.g. move to window, add shading, adjust grow-light duration). Scenarios: smart planters,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill accepts local files and network URLs and states that historical reports are fetched from a cloud API, but it does not clearly warn users that their files, URLs, and report queries may be transmitted to external services. This weakens informed consent and can expose sensitive images, metadata, or usage history to third-party systems unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill auto-triggers on broad conditions such as any plant image needing light diagnosis and generic history-report phrases, which can cause unintended invocation of analysis or cloud-backed report retrieval. This increases the chance of processing user files or querying remote data without sufficiently explicit user intent, creating privacy and overreach risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code hard-codes the command description and multiple help strings in Chinese, which imposes a specific language on users. The file does not provide any opt-in, alternative locale, or justification that this skill is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill forwards user-supplied remote URLs directly to the backend analysis service as videoUrl without any visible disclosure to the user that the URL will be shared with a third party. This can leak sensitive internal or private URLs and may also cause the downstream service to fetch attacker-controlled or internal resources, depending on server-side protections.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill reads arbitrary local file contents and sends them to an external analysis API via the files parameter, but this code provides no user-facing notice, consent flow, or data-classification checks before exfiltration. In a skill context, this can unintentionally transmit sensitive local data if a user supplies the wrong path or does not realize the file will leave the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function forwards a local file path or URL to skill.get_output_analysis, which the finding indicates results in video data being transmitted to an external analysis service. The CLI provides no clear consent prompt, privacy notice, or explicit warning that potentially sensitive video content may leave the local environment, creating a real privacy and data-handling risk for users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file defines a delete method that issues an HTTP POST request, which is a potentially destructive operation. There is no confirmation prompt, user-facing log, or inline warning in this file indicating that invoking this method may delete remote data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code automatically creates a directory and writes a YAML config file when the target path does not exist, but provides no prompt, log, print, or explanatory comment warning the user that a file will be created. A similar silent overwrite pattern also appears in the save routine, making file modification behavior non-transparent to users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring at L25-L35 explicitly states that the function calls the openclaw agent command through subprocess. However, the subprocess import and run invocation are commented out at L4 and L61-L66, while the live code assigns result to an empty dict at L68 and then attempts to use it as if it were a subprocess result object. This is an active contradiction between stated behavior and actual code.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The OpenIdUtil class docstring says missing open-id values are resolved by first checking a workspace file, then reusing or creating a local database user. However, the method get_api_key_file_open_id actually reads data/smyx-api-key.txt and treats its contents as an identity value, which is a stronger and different source of identity than the docstring's framing suggests. This is an active intent mismatch because the documentation presents 'api-key' storage as an 'internal identity value' fallback rather than clearly documenting that the code derives the runtime user identity from that file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code silently reads an identity value from a workspace file and uses it as the current open-id. In an agent/skill environment, workspace files may be inherited, prepopulated, or manipulated by other components, so this can cause unintended identity reuse, cross-user confusion, or unauthorized actions under the wrong account without explicit user awareness.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: The helper automatically posts identity-bearing registration/login data (openId, mobile, source) to an external service to create or recover a user context. Because this happens implicitly during request setup, it can disclose identifiers to a remote endpoint and create accounts or sessions without a clear user-triggered authorization step.
Content: Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.
python
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"):

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This request path automatically attaches user identity and authentication material (X-Access-Token, X-Api-Key, Authorization, pnaUserName) to outbound HTTP requests, with no visible consent gate in this code. In a skill context, automatic credential propagation to remote services materially increases privacy and account-risk exposure if endpoints are misconfigured, overbroad, or triggered unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The returned recharge instructions are hard-coded entirely in Chinese and direct the user to enter Chinese commands, with no indication that another language can be used. This creates a language/locale policy issue because the skill imposes a specific language on users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The method returns a fixed Chinese-language heading string, which imposes a specific language on users. The file does not show any option for selecting locale or documenting that the skill is intentionally region-specific, so this appears to violate the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's parser description and most arguments consistently describe indoor plant light-stress analysis, but the --list help text says it displays a 'pet health analysis list'. This is an active documentation contradiction that misstates the feature's intent and could mislead users about what data is being accessed or shown.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comment claims user input is not required for identity initialization, but the code accepts a user-supplied open_id and passes it into identity resolution. In a skill that can list analysis records, this can enable insecure direct object reference or identity confusion if downstream code trusts the supplied identifier and lacks authorization checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document title and all user-facing documentation content are written in Chinese, with no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This Python file issues network calls via http_post in analysis_result and analysis, which may transmit user or system data to external services. The file contains no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that these requests occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Several returned strings, including report headings and status/error messages, are fixed in Chinese. This imposes a specific language on all users without any opt-in, fallback, or locale selection mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code reads environment variables containing user identifiers such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID, but does not disclose this access through comments, logging, prompts, or documentation in the file. Accessing identity-related environment data without notice can surprise users and operators.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code file contains natural-language text stating the component is localized in Chinese, but there is no indication that users can opt into another language or that the locale restriction is required for a region-specific purpose. Under the policy rule for language/locale constraints, hard-coded language expectations in user-facing text can be a policy violation when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2