Back to skill

Security audit

Plant Disease Recognition Skill | 植物病害识别技能

Security checks across malware telemetry and agentic risk

Overview

The skill performs plant disease cloud analysis, but it also silently creates or reuses persistent user identity state, stores auth tokens, retrieves history, and is configured for insecure private dev endpoints.

Install only if you are comfortable with media and report metadata being sent to the provider's cloud service, with the skill creating or reusing a persistent local identity and storing service tokens. Review or change the bundled dev HTTP/private endpoint configuration before use, and avoid submitting sensitive plant, location, farm, or account-related media unless the provider's retention and deletion guarantees are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (31)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
76% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
76% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes local scripts, handles local files, writes outputs, and accesses remote services, yet it declares no explicit permissions. This creates a transparency and least-privilege problem: an agent or reviewer may treat the skill as lower risk than it is, while it can still perform filesystem, shell, environment, and network actions. In the context of an agent skill, hidden capability breadth increases the chance of unsafe execution and data exposure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is plant-disease recognition, but the skill also describes cloud history retrieval, report-link generation, local identity creation/reuse, remote authentication, and local token/state handling. That mismatch is dangerous because users and orchestrators may consent to image analysis without realizing the skill also performs account linkage and persistent remote interactions, expanding privacy and abuse risk beyond the stated task.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Automatically creating or reusing internal user identities for report association introduces identity-management behavior that is not necessary for basic image/video diagnosis and is hidden from the user. In an agent context, silent identity linkage can enable cross-session tracking, unintended account correlation, and retrieval of another user's report history if identity handling is weak or default-user logic is flawed.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The privacy statement says raw video data is deleted immediately and not persistently stored, yet the workflow supports historical cloud report retrieval and local output saving. That inconsistency is dangerous because it can mislead users about retention and privacy guarantees, causing them to share sensitive media under false assumptions about deletion and storage.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill is presented as a plant-disease recognition tool, but it also exposes a history-listing capability tied to an internal user identifier. That creates a hidden secondary data-access surface that may reveal prior analysis records and user-associated activity beyond the stated purpose, increasing privacy and authorization risk if access controls are weak or implicit identity resolution is abused.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code initializes and relies on internal identity (`open_id`) machinery even though the advertised function is simple image/video disease recognition. Introducing hidden identity handling expands the trust boundary and can enable unintended account scoping, data association, or access to user-specific history, especially because `open_id` resolution happens automatically and is not transparently exposed to the user.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The skill accepts arbitrary remote URLs and forwards them to a backend for processing, expanding the trust boundary beyond local user-provided files. If the backend fetches these URLs server-side, this can enable SSRF-style abuse, internal network probing, or access to unintended resources, especially since there is no visible allowlist or URL validation here.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation is materially inconsistent with the declared skill purpose: instead of plant disease recognition for images/video with structured diagnosis, it acts as a generic video analysis and history retrieval wrapper. This kind of capability mismatch is dangerous because it can misroute user data to an unrelated backend, violate user expectations and authorization boundaries, and conceal undeclared processing behavior behind a benign agricultural description.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file implements a generic API client with broad CRUD and arbitrary HTTP request capabilities that are not narrowly scoped to plant disease recognition. In a skill advertised as image/video-based disease diagnosis, this creates an unnecessary remote-action surface that could be repurposed to access, modify, or delete unrelated backend resources if exposed to untrusted inputs or higher-level orchestration.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
User account lookup functionality is unrelated to plant disease analysis and introduces access to identity-related data. Even if intended for convenience, it expands the skill's capability into user enumeration or profile retrieval, which can expose sensitive account metadata or enable lateral misuse.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The configuration class reads environment variables containing user identifiers such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID, then stores them in globally accessible class attributes. In a plant disease recognition skill, collecting and retaining user identity data is not necessary for core functionality and increases privacy exposure and cross-context data leakage risk if other modules log, transmit, or reuse these values.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This file exposes a very large catalog of scene codes spanning health, child monitoring, emotion analysis, elderly monitoring, workplace stress, and other unrelated domains far beyond plant disease recognition. In a narrowly declared plant disease skill, this broad shared capability surface suggests unnecessary latent functionality and raises the risk of feature confusion, unauthorized routing into other analysis domains, or accidental processing of sensitive categories if these constants are used dynamically elsewhere.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The file contains generic user-account persistence logic that is unrelated to a plant disease recognition skill's stated purpose. Capability drift like this increases the attack surface, enables unexpected storage of identity data, and makes it harder to reason about what the skill is actually doing or should be permitted to do.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The model stores token and open_token fields even though the skill description gives no reason to collect or retain authentication-like secrets. Unnecessary credential storage materially raises the risk of secret leakage, unauthorized account access, and privacy violations if the local SQLite database is exposed or reused across agents.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The utility layer performs remote account provisioning, login, token retrieval, and local token persistence even though the advertised skill is plant disease recognition. That is a significant capability mismatch: it silently establishes user identities and authentication state, which can enable unintended outbound access, account creation, and tracking outside the skill's stated purpose.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code inspects workspace environment variables and local files to derive an internal open-id, which is unrelated to plant disease analysis. Accessing environment-derived workspace context and identity material increases the skill's ability to fingerprint the host and bind actions to a local identity without clear necessity.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code creates and persists synthetic default user identities in a local database when no identifier is supplied. This enables silent identity creation and durable tracking/account linkage beyond the skill's declared purpose, which is especially concerning in a diagnostic skill that should not need user account lifecycle management.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Broad trigger phrases for history-report queries can cause the skill to invoke cloud report listing when a user makes an ordinary or ambiguous request. In an agent system, overly permissive activation can lead to unintended data access or disclosure of report metadata without sufficiently clear user intent.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The default activation condition is very broad and can auto-trigger disease-analysis behavior whenever a user shares plant images or mentions symptoms. In agent environments, ambiguous auto-invocation can cause files or URLs to be processed and transmitted without a sufficiently explicit request, increasing privacy and safety risk.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The code reads local file contents or accepts remote media URLs and transmits them to an external analysis service without any visible user-facing notice, consent flow, or data-handling disclosure in this file. For image/video analysis, this may expose sensitive media, metadata, or proprietary agricultural data to third-party processing unexpectedly.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The debug log prints the full prompt content, which may contain sensitive user data, proprietary inputs, or secrets. If debug mode is enabled and logs are collected centrally or exposed to operators, this creates an information disclosure risk without any sanitization or redaction.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The utility uses environment-derived workspace paths to locate data directories without any user-facing disclosure. In agent environments, workspace paths can reveal deployment structure and enable unexpected access to local files, making silent use of this context risky and unnecessary for the stated plant-disease function.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code automatically creates local data and skills directories for the current agent without informing the user. Silent filesystem modification expands persistence and installation surface, which is more dangerous because it is unrelated to simple plant-disease recognition and may surprise operators reviewing least-privilege behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2