Back to skill

Security audit

Plant Growth Stage Detection | 植物生长阶段自动判定

Security checks across malware telemetry and agentic risk

Overview

This plant-analysis skill performs related cloud analysis, but it also silently creates or reuses identities, stores tokens locally, and uses under-disclosed remote endpoints.

Install only after you are comfortable with cloud upload of plant media, automatic report-history lookup, and local account/token persistence. Treat this as a Review item: use a dedicated workspace/account, inspect or change the dev endpoint configuration before running, and avoid using it with private greenhouse/home imagery unless the publisher clarifies identity, retention, and endpoint behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
85% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises image/video stage analysis but also instructs shell execution, local file handling, network access, environment use, and writing outputs without declaring those capabilities as permissions. This creates a transparency and governance gap: an agent may invoke broader powers than a user or platform reviewer would expect, increasing the chance of unintended data access or exfiltration.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest frames the skill as plant-stage detection and guidance, but the body adds mandatory cloud history retrieval and report-link generation, expanding the actual data flows and functionality beyond the stated purpose. This is dangerous because users may provide media for local analysis while the skill silently performs account-linked remote queries and surfaces remote report URLs.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill states that, if no upstream identity is provided, it will automatically reuse or create a local default user and associate reports to that identity. For a plant analysis skill, hidden identity creation is unrelated to the core function and risks cross-user data mixing, unauthorized report access, and non-consensual tracking of analysis history.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
One section restricts output to stage judgment and confidence, while other sections instruct the skill to provide care guidance, report links, and historical report queries. These conflicting instructions obscure the true behavior of the skill and make it easier for additional networked or advisory functions to be performed without clear user expectation.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation behavior materially diverges from the manifest: it performs generic video analysis and history listing instead of plant growth stage detection from periodic plant images. This is dangerous because users and downstream agents may grant inputs, permissions, or trust based on the declared purpose, while the actual code routes data to a different analysis path and capability set, creating a deceptive-functionality and unintended-data-processing risk.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code exposes a generic API-driven analysis function instead of a plant-specific developmental stage recognizer, which broadens behavior beyond the declared scope. In a skill ecosystem, this mismatch can mislead orchestrators into sending inappropriate data or trusting outputs as plant-stage determinations when they may be produced by an unrelated backend service.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring explicitly states that the function analyzes video via an API, contradicting the manifest's claim of image-based plant growth stage detection. While this is partly a documentation issue, such contradictions are security-relevant because they signal hidden or misrepresented capabilities and increase the chance of unsafe integration decisions and user deception.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This file implements a generic API wrapper with arbitrary URL-based GET/POST/PUT/DELETE and CRUD helpers that are far broader than what is needed for plant growth stage detection. In a skill whose stated purpose is image-based phenology analysis, this unnecessary network and mutation surface increases the chance the skill can be repurposed to access or modify unrelated backend resources, especially if untrusted inputs can reach the url/args parameters.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The add/edit/delete/http_put/http_delete methods expose direct remote state-changing capabilities without any visible restriction, scoping, or alignment to the skill's declared purpose. If reachable by higher-level skill logic or attacker-controlled inputs, these methods could be used to alter or delete remote data or trigger unauthorized actions on backend services.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The file implements persistent user/account storage in a skill whose declared purpose is plant growth stage detection from images. This capability expansion creates unnecessary collection and retention of user identifiers, tokens, and profile data, increasing privacy and breach risk without clear functional justification. Mismatch between stated purpose and implemented data handling is especially concerning in agent skills because users and reviewers may not expect account persistence.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This module performs broad local database initialization, CRUD support, and schema alteration for sys_user, which materially exceeds the manifest's narrow plant-analysis behavior. Unnecessary data-layer and user-table capabilities expand attack surface, enable hidden persistence, and make it easier for the skill to store or manipulate unrelated user data. The enforced shared-workspace database behavior further increases the blast radius if abused or compromised.

Intent-Code Divergence

Low
Confidence
74% confidence
Finding
The top-level documentation presents the module as a generic lightweight SQLite/CRUD wrapper, but the implementation also forces cross-skill shared-database path redirection and mutates a specific sys_user schema. This documentation/behavior mismatch can conceal the true scope of persistence and hinder effective review, which is a security transparency problem. In a skill unrelated to account management, that hidden scope is more suspicious than it would be in an explicitly data-management-focused component.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility layer performs generic account bootstrap, token handling, and remote API interaction that are not necessary for plant growth stage detection. The mismatch between declared skill purpose and actual capabilities increases the likelihood of covert data exfiltration, unauthorized service use, and expansion of the skill's privileges beyond user expectations.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code automatically resolves, creates, and persists user identities, including generating default open IDs and reusing local records, without any clear relationship to image-based plant phenology analysis. This can silently establish service identities and enable backend access on behalf of the environment or user, which is especially risky when hidden inside an unrelated skill.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code inspects environment variables, file paths, and workspace layout to determine agent context and locate shared data/skills directories. In a plant-vision skill, this broad environmental awareness is unnecessary and can facilitate lateral access to workspace resources, making the skill more capable than its stated purpose suggests.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default trigger activates whenever a user provides plant imagery needing analysis, which is broad enough to cause automatic invocation in ambiguous contexts. Overly broad triggering increases the risk of sending user media into file-saving or cloud-backed workflows without sufficiently specific consent or intent confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation does not clearly warn users that uploaded media and report-history requests are sent to external API/cloud services. This omission undermines informed consent and can expose sensitive greenhouse, home, or operational imagery and account-linked history to remote processing unexpectedly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code resolves an internal identity through a hidden `open-id` mechanism and explicitly suppresses user-facing disclosure in help output. In a skill that can list historical analysis reports, hidden identity binding increases the risk of unauthorized access to another user's data, silent account association, or privacy violations if the resolver derives identity from ambient state without explicit consent and visibility.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill reads local file contents or forwards remote URLs to a backend analysis service without any consent prompt, privacy notice, or visible restriction in this code path. In a greenhouse or home-grow context, uploaded media and URLs may contain sensitive environmental, location, or operational data, so silent transmission increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debug logging can emit request/response metadata that may include sensitive payloads, tokens, or identifiers. Because this occurs transparently and without user-facing disclosure, it can leak secrets into logs or consoles accessible to other users or processes.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill silently reads an identity value from workspace data/smyx-api-key.txt and reuses it as an internal open ID. Undisclosed credential or identity harvesting from local workspace files violates least surprise and can cause unauthorized use of preexisting identities.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code performs an outbound login/registration-style request and then persists returned tokens locally, all without an obvious user prompt or disclosure. This creates hidden authentication state and increases the risk of account misuse, token leakage, and unexpected remote service enrollment.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2