Indoor Plant Light Stress Detection | 室内植物光照不足/过强识别

• Outcome: Review
• Latest audit: Aug 29, 2026 · 6:39 AM UTC
• Version: 1.0.9

Overview

This skill provides the advertised plant image analysis, but it quietly sends media and identity data to remote services and persists login tokens locally with limited user-facing disclosure.

Review this skill before installing. Use it only if you are comfortable sending plant images or videos, URLs, report metadata, and an automatically chosen user identity to the publisher's service, and be aware it may create a local database with reusable tokens. The dev/private HTTP endpoint configuration should be corrected or explained by the publisher before normal use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 86% confidence
• Finding: The list() method applies getattr(self.__model__, key) using filter keys supplied by callers. While this is not classic SQL injection because SQLAlchemy parameterizes values, untrusted keys can still expose unintended model attributes, trigger exceptions for invalid fields, and weaken authorization assumptions if higher layers rely on this DAO to restrict queryable columns.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 85% confidence
• Finding: The count() method repeats the same caller-controlled dynamic attribute selection pattern as list(). If external input reaches filters, attackers may enumerate schema behavior, cause predictable errors, or query on fields that should not be user-selectable, which can aid information disclosure or logic abuse.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A generic utility module is performing remote authentication, token management, local user persistence, and automatic account creation. That is risky because callers may trigger network-side identity provisioning and credential handling implicitly, making security review, consent, and least-privilege boundaries much harder to enforce.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The code comments acknowledge header sensitivity, but error/debug paths still log request data, response bodies, and exception details inconsistently. If request payloads contain identifiers, secrets, or personal data, those values may be exposed in console logs or centralized logging sinks during failures.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill’s history-report trigger examples include broad phrases such as '历史报告'/'history report', which can cause unintended activation of cloud report-list retrieval when a user is asking more generally about prior results. In an agent setting, overly broad triggers can lead to surprise tool execution and unnecessary disclosure of stored report metadata.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill accepts local files, videos, and network URLs and states that history/report data is queried from a cloud API, but it does not clearly warn users that uploaded media and generated reports may be transmitted to and stored by a remote service. This creates a privacy and consent risk, especially because images/videos from homes or offices can contain sensitive visual information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sends either a user-supplied remote URL or the full contents of a local file to an external analysis API, but this code shows no user-facing consent, warning, or data handling disclosure before transfer. That creates a privacy and data exfiltration risk, especially if users provide sensitive local media or internal URLs without understanding that the content will leave the host environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The request flow automatically sends user identity values and authentication tokens to remote services, including silent registration/login behavior, without any visible user-facing disclosure or confirmation in this file. In an agent-skill context, implicit exfiltration of identifiers and credentials is more concerning because users may expect a local helper but actually trigger remote account operations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code automatically reads a workspace file named smyx-api-key.txt and uses its contents as an internal identity source without notice. In a multi-skill or agent workspace, silently consuming credential-like material from disk can surprise users and may cause unintended credential use or cross-context identity leakage.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This POST sends openId/mobile/source values to a remote endpoint to silently register or authenticate a user. In context, the transmission is especially sensitive because it happens from a utility helper, may occur automatically, and combines identity handling with network operations users may not expect.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2