Orchid Growth Status Detection (Shoots / Spike / Roots) | 兰花新芽/花梗/根系状态识别

• Outcome: Review
• Latest audit: Aug 17, 2026 · 7:39 PM UTC
• Version: 1.0.8

Overview

This orchid analysis skill is mostly coherent, but it silently provisions and reuses a remote identity while storing service tokens locally, which users should review before installing.

Install only if you are comfortable with orchid photos/videos or supplied URLs being sent to the configured cloud service, history reports being tied to an internal identity, and local workspace storage of account tokens. Prefer an explicit consent flow or documentation update before use in a privacy-sensitive workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 80% confidence
• Finding: This code uses getattr(self.__model__, key) on keys taken directly from the caller-provided filters dict, without validating that the key is an allowed column name. An attacker who can influence filters may trigger access to unintended model attributes, causing exceptions, unstable query behavior, or bypass of intended field restrictions; in some ORM contexts, this pattern can expose internal attributes or enable querying on fields that should not be user-selectable.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: As in list(), count() reflects over caller-controlled filter keys with getattr(self.__model__, key) and does not restrict which attributes may be queried. This can lead to denial of service via exceptions, querying on unintended fields, or exposure of model structure and internal behavior through malformed requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes capabilities consistent with shell execution, file access, environment access, and network use, yet declares no permissions or user-facing disclosure of those behaviors. This creates a transparency and consent gap: users may invoke what appears to be a simple orchid-analysis skill without realizing it can read/write local data, call remote services, and execute scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is orchid image analysis, but the behavior includes cloud history retrieval, silent account-style registration, and local persistence of identity/tokens. This mismatch is dangerous because it hides authentication, tracking, and data-retention behavior behind an innocuous plant-care workflow, undermining informed consent and increasing privacy and account-abuse risk.

Description-Behavior Mismatch

Low

• Confidence: 71% confidence
• Finding: The history-listing function exposes prior analysis reports through a CLI path that is not part of the stated orchid-analysis feature set. Because it retrieves results by open_id and the skill also performs hidden identity resolution, this creates a real risk of unintended data exposure or enumeration of prior user analyses.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Introducing an internal open_id capability for a simple orchid image-analysis tool expands the data collected beyond what users would reasonably expect. Identity binding can enable tracking, correlation of uploads and report history, and access to user-scoped data if authorization controls elsewhere are weak.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation accepts video files and remote video URLs even though the skill is presented as orchid analysis from HD images. This capability mismatch is dangerous because it broadens the data types and collection surface beyond user expectations, increasing the chance of unintended ingestion, policy bypass, or misuse of the skill for unsupported media processing.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill exposes report listing and export-link generation functions that are not described in the stated orchid-analysis purpose. Hidden data-access features are risky because they may reveal prior analysis records or report artifacts to callers who only expected single-item analysis, potentially expanding access to stored user data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code forwards arbitrary http/https URLs to the backend for analysis, creating a network-ingest path not justified by the manifest's image-analysis description. This is dangerous because it can enable backend fetching of attacker-controlled URLs, which may lead to SSRF-like access patterns, unexpected third-party data retrieval, or analysis of non-user-owned content.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation materially diverges from the declared orchid image-analysis purpose and instead acts as a generic video-analysis wrapper. This kind of scope mismatch is dangerous because it can hide broader data-processing behavior from reviewers and users, enabling unauthorized ingestion of non-orchid media and bypassing trust decisions based on the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Accepting arbitrary network video URLs expands the skill from local orchid-photo analysis into remote content retrieval and analysis. That increases risk by allowing the skill to process untrusted external resources, potentially exfiltrate metadata through backend requests, and operate on content well beyond the user's expected orchid-care use case.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The history-listing capability exposes prior analysis records unrelated to the stated single-item orchid assessment function. In a skill context, undocumented access to historical outputs can leak user activity, media references, or derived results across sessions or identities if access control is weak or misunderstood.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The CLI and docstrings repeatedly present this as a general video-analysis tool, which directly contradicts the orchid HD image-analysis manifest. Misleading interface text is a security issue here because reviewers and users may approve the skill for a narrow horticulture use case while the shipped interface invites broader media-processing behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file exposes generic add/edit/delete operations plus arbitrary HTTP GET/POST/PUT/DELETE wrappers that accept caller-supplied URLs and arguments, which is far broader than an orchid image-analysis skill should require. In a skill/plugin context, this creates a capability for unintended remote requests and state-changing actions against backend services if higher-level controls are weak or bypassed.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The implementation behaves as a general-purpose API client rather than a specialized orchid growth-status analyzer, including pagination, record mutation, download URL generation, and arbitrary outbound requests. This mismatch increases risk because the skill can be repurposed to access or modify unrelated resources, making abuse more plausible in an agent environment where tools should be least-privileged and task-bounded.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The file defines persistent local storage for user/account records, including identifiers and profile-like fields, even though the stated skill is orchid image growth analysis. Unrelated identity persistence increases attack surface, creates unnecessary retention of personal data, and may enable cross-skill tracking or misuse if this shared DAO is reused broadly.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The model stores authentication-like material such as token and open_token along with user identity fields, without any visible need tied to orchid health analysis. Persisting such secrets locally in a shared SQLite database raises the risk of token theft, account linkage, and unauthorized access if the file system, workspace, or another skill can read the database.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This shared utility performs identity resolution, account provisioning, token caching, authentication header injection, and remote API interaction that go far beyond orchid image analysis. In the context of a plant-care skill, this creates an unjustified capability to create or reuse accounts and transmit credentials or identifiers to external services, expanding privacy and abuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The utility inspects the agent workspace, creates data/skills directories, reads local files, and ties into local user-database behavior unrelated to orchid growth detection. In this skill context, such broad filesystem and identity-state access is unnecessary and increases the chance of privacy leakage, unwanted persistence, or cross-agent contamination.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The _get_or_create_user flow silently performs remote phoneLogin-style registration/login with register enabled, using a derived openId/mobile value. For an orchid analysis skill, automatic remote account creation/login is unjustified and dangerous because it can enroll users without informed consent and link local identities to external services.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: A default trigger that activates whenever users provide orchid-related images or videos can cause unintended execution, including automatic file handling and remote processing. In this skill, the risk is amplified because invocation may lead to local file saving and cloud API interaction without a narrowly scoped user request.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The keyword trigger includes broad horticulture terms like repotting and fertilizing, which may activate the skill even when the user is asking general care questions rather than requesting image analysis. Ambiguous activation can unexpectedly route user content into this skill's automated workflow, including cloud lookups and file handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill does not clearly warn users that local files and supplied URLs may be transmitted to remote APIs for analysis and historical-report queries. This is a meaningful privacy issue because plant images, metadata, URLs, and associated user identifiers or tokens may leave the local environment without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code resolves a current internal identity automatically and hides the associated CLI option from normal help output. Hidden identity resolution reduces transparency and can cause users to unknowingly operate under a persistent account context, increasing privacy risk and the chance of unauthorized access to stored analysis history.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill reads local file contents and uploads them to an analysis service without any user-facing disclosure in this component. For a media-analysis skill, silent upload of user files creates privacy and data-handling risk because sensitive images or videos may be transmitted to a remote service without clear notice, scope, or retention expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2