Lawn Health Assessment | 草坪枯黄率与杂草密度评估

• Outcome: Review
• Latest audit: Aug 30, 2026 · 8:12 AM UTC
• Version: 1.0.9

Overview

This lawn-analysis skill has a plausible purpose, but it silently binds users to accounts, stores identity tokens locally, and uses under-scoped network behavior that users should review before installing.

Install only if you are comfortable with the skill sending lawn images or URLs to its configured service, automatically creating or reusing an internal account identity, storing identity and tokens in a local workspace database, and querying cloud report history. Review or remove the bundled dev configuration before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 78% confidence
• Finding: This query builder accepts arbitrary filter keys and passes them to getattr(self.__model__, key) without validation. If untrusted input reaches this method, an attacker can trigger unexpected attribute access, application crashes, or query manipulation against unintended ORM attributes, which is especially risky in a generic DAO reused across the codebase.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 78% confidence
• Finding: Like the list() method, count() dynamically resolves model attributes from caller-supplied keys with no validation. In a shared DAO layer, this expands the attack surface for denial-of-service through malformed requests and unintended access to internal ORM attributes if exposed through higher-level APIs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises executable behavior with access to environment variables, local files, network, and shell execution, but does not declare permissions transparently. That creates a trust gap for users and host systems, because a seemingly simple image-analysis skill can silently perform broader actions such as local persistence, outbound requests, and command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The manifest describes a narrow lawn-image analysis function, but the documented behavior includes hidden identity management, remote login/token acquisition, local SQLite state, and cloud history/report retrieval. This mismatch is dangerous because users and orchestration systems may grant trust or trigger the skill under false assumptions while it performs broader data handling and account-linked operations.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documented API describes pet health analysis endpoints and scenario codes, which materially contradicts the declared lawn health assessment purpose of the skill. This kind of domain mismatch can cause the agent to call the wrong backend, expose unrelated data exports, or process data under incorrect assumptions, creating integrity and potential confidentiality risks if integrated as-is.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation behavior materially conflicts with the declared skill purpose: instead of assessing lawn health from top-down images, it performs video analysis and exposes a history-listing function. This kind of capability mismatch is dangerous because users, platforms, or downstream agents may grant permissions and trust based on the manifest, while the code processes different inputs and may access or disclose unrelated historical analysis data.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The CLI help text and argument structure document a video-analysis workflow that contradicts the manifest’s image-assessment intent. Misleading operational documentation increases the chance that users or orchestrators invoke the skill with incorrect trust assumptions, and in combination with hidden/internal parameters can mask non-obvious behavior that was not expected from the advertised lawn-health use case.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file exposes a broadly capable API wrapper with generic pagination, CRUD, and arbitrary HTTP methods that are not constrained to the skill's stated lawn-health image-analysis purpose. In an agent-skill context, this unnecessarily expands the skill's authority and can enable unintended access to unrelated backend endpoints or data if other components can pass attacker-controlled URLs or parameters.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The add, edit, delete, and generic HTTP helper methods allow this skill to issue arbitrary state-changing requests without any visible restriction to approved resources or the declared image-analysis workflow. If an attacker or misused caller can influence the target URL or payload, the skill could be used to modify or delete remote resources far outside its intended domain.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The shared config layer reads user-identifying environment variables such as sender open IDs and usernames even though this lawn-health skill does not need personal identity data to analyze turf imagery. This creates unnecessary data access and expands the privacy attack surface, especially because shared modules may propagate these values into logs, requests, or downstream components without clear need-to-know boundaries.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file defines generic user/account persistence, including identity fields and token storage, which is unrelated to the declared lawn-image analysis capability. Capability mismatch is dangerous because it can conceal unnecessary collection and retention of user data, enlarging privacy and compromise impact far beyond what users would expect from an image assessment skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The model stores username, real name, email, birthday, and token/open_token values for a skill whose stated function is lawn-health image analysis. Unnecessary retention of identity and authentication-like secrets creates avoidable privacy and account-compromise risk, and the mismatch with the declared capability makes this more concerning because users would not reasonably expect such data handling here.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The lawn-health skill exposes a generic `ai_chat(prompt, session_id, timeout)` interface that is unrelated to the stated purpose of image-based turf assessment. Even though the current implementation is mostly stubbed, this creates an unjustified pathway for arbitrary prompt-driven agent behavior in a domain-specific skill, expanding attack surface and enabling future misuse if the commented command execution is restored.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility module includes account provisioning, token recovery, local user lookup, and authenticated API request behavior that is unrelated to lawn image assessment. That broadens the skill's privilege and creates hidden identity and network side effects, making the skill capable of acting as a general authenticated client rather than a narrowly scoped image-analysis tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code silently derives or creates a default `open-id`, including generating synthetic local identities and persisting them for reuse. This can cause actions to be performed under an implicit account without informed user approval, undermining auditability, consent, and account-bound access controls.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The utility inspects workspace paths, environment variables, and agent layout to locate shared `data` and `skills` directories, behavior that exceeds what is needed for local lawn-health scoring. In a plugin/agent environment, this increases the blast radius by enabling cross-workspace file discovery and persistence locations that may expose or contaminate other agent contexts.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The automatic trigger phrases for history lookup are broad enough to match general requests, which can cause the skill to invoke cloud report-query behavior unexpectedly. In a system with multiple skills, this increases the chance of unintended data access or disclosure of account-linked historical reports.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill says uploaded attachments are automatically saved as local files, but does not clearly warn users about retention, storage location, or lifecycle. This is risky because image/video uploads may contain sensitive property, location, or operational information that persists on disk beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script silently resolves an internal user identity via OpenIdUtil.resolve_current_open_id without clear disclosure or explicit consent. This can cause actions, listing behavior, or analysis records to be tied to an internal identity unexpectedly, creating privacy, auditability, and authorization concerns if a user unknowingly accesses or modifies another identity's data context.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill submits user-provided files or remote URLs to an analysis service via `self.analysis(...)`, but this file shows no user-facing notice, consent gate, or disclosure that content will be transmitted off the local environment. For a media-analysis skill handling potentially sensitive imagery, silent network submission creates a real privacy and data-handling risk, especially in enterprise or regulated deployments.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Accessing environment-derived identity values without disclosure reflects hidden collection of personal identifiers in a skill whose stated function is lawn image analysis. Even if not immediately exfiltrated here, undisclosed collection violates data minimization expectations and can enable secondary misuse through logging, telemetry, or later processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Enabling `http.client` and `urllib3` debug logging can expose request URLs, bodies, and authentication material in logs during debug runs, without any user-facing warning. Since this same module handles tokens and identity-bearing requests, the disclosure risk is amplified.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code reads an internal identity value from `data/smyx-api-key.txt` automatically and uses it as an operational identity without clear disclosure or consent. This hidden identity sourcing can cause the skill to act under credentials the user did not intentionally provide for this lawn-analysis task.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The HTTP helper automatically attaches tokens, app identifiers, username/open-id values, and tenant/platform metadata to outbound requests, and may trigger login or account creation as part of request handling. For an image-analysis skill, these undisclosed network side effects create significant privacy and credential exposure risk and violate least surprise.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: The code sends a POST request to a health-system login endpoint with `openId`, `mobile`, and source metadata in order to create or retrieve an account. This is a real external transmission of identity data unrelated to core lawn scoring and is especially concerning because it occurs automatically within shared utility logic.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2