Security audit

Orchid Growth Status Detection (Shoots / Spike / Roots) | 兰花新芽/花梗/根系状态识别

Security checks for vulnerabilities and agentic risk

Overview

The orchid-analysis skill uses cloud APIs but also silently manages account identities, stores tokens locally, defaults to plaintext dev endpoints, and can steer users toward installing a payment skill.

Review this skill carefully before installing. It may upload orchid images or videos to a cloud service, silently create or reuse an account identity, store service tokens in the workspace, retrieve account-linked history, and display payment-skill installation instructions from a remote billing response. Use it only if you trust the publisher and can verify the configured endpoints are HTTPS production services.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: skills/smyx_common/scripts/util.py:662
Finding: Server-Triggered Payment Skill Installation Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/smyx_common/scripts/config-dev.yaml:1
Finding: Identity, Authentication Tokens, and User Media Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:571
Finding: Authentication Headers Can Be Forwarded to Arbitrary Absolute URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/dao.py:141
Finding: Authentication Tokens Persisted Unencrypted in a Shared SQLite Database
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs authenticated external API requests, local file operations, workspace detection, identity creation/retrieval, token persistence, and login/refresh flows despite presenting as a simple orchid-growth analyzer. This is a substantial overreach for the stated purpose and can expose users to hidden authentication, storage, and remote-account interactions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation materially diverges from the advertised skill purpose: it performs generic video analysis and exposes analysis-history functionality instead of orchid image growth-status inspection. This is dangerous because users, reviewers, or calling systems may grant the skill permissions and trust assumptions appropriate for plant-image analysis, while the code actually processes different inputs and invokes hidden backend behavior, increasing the risk of deceptive data handling or unintended capability exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The CLI explicitly presents itself as a 'video analysis tool' and accepts local video paths and video URLs, directly contradicting the advertised orchid HD image-analysis use case. In a skill ecosystem, this kind of scope mismatch is a supply-chain trust issue: operators may approve or auto-run the skill for low-risk horticulture image processing while it performs broader media ingestion and backend access than expected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This module provides a generic persistence layer for user records, including create, update, delete, and lookup operations, which is unrelated to orchid image growth-status analysis. In the context of this skill, collecting and mutating local identity data materially expands data-handling scope and creates unnecessary privacy, retention, and abuse risk if the skill or adjacent components invoke it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The User model stores identity and authentication-adjacent fields such as username, email, token, and open_token without any justification tied to orchid-health analysis. Retaining such secrets or identifiers in a local SQLite database broadens the blast radius of compromise and may expose credentials or session material if the workspace is read by other skills, agents, or users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility file performs authenticated API interaction, token management, and implicit account lifecycle operations that are unrelated to orchid image growth analysis. In the context of a plant-care skill, this creates hidden capability for identity handling and remote data exchange, increasing privacy and supply-chain risk because users would not reasonably expect account provisioning or tokenized backend access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code silently calls a remote /sys/phoneLogin endpoint with register=1 and user identifiers, meaning it can create or log in accounts automatically without user awareness. For an orchid-analysis skill, this is unjustified behavior and dangerous because it establishes remote identities and transmits potentially sensitive identifiers to an external service without clear consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool/permission boundaries despite documented behavior that uses shell execution, network access, local file handling, environment-derived identity, and file writes. In an agent environment, missing scope declarations can allow broader-than-expected execution and make it harder for policy layers or reviewers to constrain sensitive capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest frames the skill as visual orchid analysis, but the documentation adds cloud history lookup and report-link return behavior. This incomplete disclosure can cause users to unintentionally trigger account-scoped data retrieval or remote processing beyond the expected analysis function.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The AI role says to output only visual indicators, but other sections require care guidance, report links, and history listings. This inconsistency weakens policy predictability and can lead to unintended execution of broader actions than a reviewer or user would infer from the role section alone.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default trigger is broad enough that ordinary orchid-related conversation plus media could auto-invoke the skill. Overbroad auto-invocation is dangerous because it can silently cause file handling, network calls, or cloud analysis when the user did not clearly request those actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Broad natural-language phrases automatically triggering history queries can cause unintended access to account-linked historical data. In this context, the danger is elevated because history retrieval is cloud-based and internally identity-associated, so a casual phrase may expose more data than the user intended to request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description omits a clear warning that uploaded files may be saved locally and processed via cloud/API services. That lack of transparency is security-relevant because users cannot make informed decisions about sharing media or invoking report queries tied to backend systems.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a narrowly scoped orchid growth-status detector, but the code accepts a generic pet_type argument and mutates ConstantEnum.DEFAULT__PET_TYPE based on values like cat, dog, or other. That indicates the implementation is shared with or oriented toward animal classification logic rather than a dedicated orchid-analysis flow.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2