Back to skill

Security audit

Plant Growth Stage Recognition Skill | 植物生长阶段识别技能

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real plant-analysis skill, but it also silently manages identity, cloud account tokens, history lookup, and local persistence in ways users should review before installing.

Install only if you are comfortable with plant images/videos or URLs being sent to lifeemergence.com cloud services, report history being queried from the cloud, workspace identity values being reused, and tokens being stored in a local SQLite database. Avoid providing sensitive local files or private/internal URLs, and review or clear the workspace data directory if you need to remove stored identity state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill manifest advertises no explicit permissions while the documented behavior requires shell execution, local file reads/writes, network access, and likely environment access. This creates a transparency and policy-enforcement gap: agents or reviewers may authorize the skill under false assumptions, enabling broader capabilities than declared.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims to perform plant growth-stage recognition, but the observed behavior extends into historical report retrieval, local identity persistence, token handling, remote authentication, and generic AI/media processing workflows. This mismatch is dangerous because users and orchestrators may grant trust and data access for a narrow agricultural function while the skill actually handles identity, storage, and broader remote-service interactions.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script includes functionality unrelated to plant growth recognition: it resolves an internal user identity and exposes a hidden list-retrieval mode that can return prior analysis data. This increases the attack surface and creates a risk of unauthorized access to user-associated records, especially because the identity handling is obscured from normal help output and may rely on ambient/internal context rather than explicit user authorization.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The code comment claims identity is not user-supplied and not exposed, but the parser still accepts a hidden --open-id parameter and conditionally uses it. This mismatch is dangerous because it obscures a security-relevant control path from users and reviewers, making it easier to misuse or bypass expected identity handling assumptions.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill accepts arbitrary http/https URLs and forwards them for backend analysis without allowlisting, domain restrictions, or clear purpose limitation. If the downstream service fetches the URL server-side, this can enable SSRF-style abuse, unexpected access to internal resources, or use of the skill as a generic remote content ingestion proxy.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation materially contradicts the advertised skill purpose: instead of plant growth stage recognition, it exposes a generic video analysis/history workflow via `skill.get_output_analysis(...)` and `skill.get_output_analysis_list(...)`. This is dangerous because users and downstream agents may grant inputs, trust, or permissions based on the agricultural manifest while the code performs a broader and different capability, creating a deceptive capability mismatch and increasing the risk of unintended data handling or misuse.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The CLI help text and docstrings repeatedly describe a generic 'video analysis tool,' which conflicts with the declared plant-growth-stage recognition purpose. This mismatch is dangerous because operators and automated systems may invoke or approve the skill under false assumptions, weakening security review and informed consent around what data is analyzed and retained.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file exposes generic network primitives and CRUD-style helpers that can issue arbitrary GET, POST, PUT, and DELETE requests to caller-supplied URLs, which materially exceeds the declared purpose of plant growth stage recognition. In a skill context, this creates a broad capability surface for unintended remote interaction, data exfiltration, or abuse of connected services if higher-level code passes untrusted or attacker-influenced inputs into these methods.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The add, edit, delete, http_post, http_put, and http_delete methods provide remote resource modification capabilities unrelated to image-based plant growth recognition. Because these methods accept arbitrary URLs and payloads with no visible policy checks, they enable unintended state-changing operations against external or internal services if misused by the surrounding skill or an attacker controlling inputs.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
This file implements generic user/account persistence and lookup capabilities that are unrelated to a plant growth stage recognition skill. Such hidden or unnecessary identity management expands the attack surface, creates opportunities for unauthorized storage of tokens and personal data, and suggests the skill can maintain user state outside its declared purpose. The mismatch between manifest and behavior makes this more suspicious, not less.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The code creates and initializes a local SQLite database despite the skill being described as analysis-oriented plant-stage recognition. Undeclared persistence can store user or operational data without clear consent or need, and it provides a foothold for hidden statefulness inconsistent with the stated functionality. In a skill context, undeclared storage is a meaningful security and trust concern.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
Schema migration plus broad record create/update/delete capabilities substantially exceed a plant recognition skill's stated role. This allows the skill to mutate local state, including user records and tokens, in ways operators may not expect, increasing the risk of covert persistence, tampering, and misuse of stored identity data. The context makes this more dangerous because the functionality is off-purpose and hidden inside a common DAO layer.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The utility layer performs account lookup, auto-registration/login, token acquisition, and token persistence to support outbound platform calls, which is unrelated to a plant growth stage recognition skill. This creates an unnecessary identity/authentication side channel: simply using the skill can provision or reuse accounts and attach user identity to remote requests without a clear, minimal-privilege justification.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads a workspace identity file and, if absent, creates a persistent default local identity, despite the skill's stated purpose being plant-stage recognition. This behavior can silently bind usage to an internal identity, persist that identity locally, and enable later authenticated actions or correlation of user activity without informed consent.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The code enumerates environment variables and filesystem layout to identify the current agent workspace and automatically creates data/skills directories. For a computer-vision plant analysis skill, this is broader-than-necessary host/workspace introspection that increases access to local agent context and creates persistence locations unrelated to the declared task.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The automatic trigger phrases for history-report lookup are broad enough to overlap with ordinary user requests, making unintended cloud queries and disclosure of prior report metadata more likely. In this skill's context, that risk is amplified because history queries are tied to internal identity association and are required to hit a remote API automatically.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that uploaded attachments are automatically saved locally, but it does not provide a clear user-facing warning, retention policy, or storage location disclosure at the point of collection. This creates privacy and data-handling risk, especially for images/videos that may contain sensitive agricultural or customer information.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code reads arbitrary local file contents into memory and submits them to an external analysis service, but this file contains no user-facing disclosure, consent gate, or data-minimization control. In an agent context, that can cause unintentional exfiltration of sensitive local files if a user or upstream workflow provides an unsafe path.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Debug mode globally enables verbose HTTP and urllib3 logging, which can expose request metadata and potentially sensitive request/response contents during normal troubleshooting. Because this utility also handles tokens and identity-bearing requests, debug logging materially raises the risk of credential and privacy leakage.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code automatically reads data/smyx-api-key.txt and uses its contents as an internal identity value without any explicit disclosure or confirmation. Silent credential or identity harvesting from the workspace is risky because users may not expect a vision-analysis skill to inspect local secret-bearing files.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
HTTP requests automatically attach tokens, API keys, tenant context, skill hub metadata, and username/open-id values, and the function can also auto-refresh credentials. For a plant recognition skill, this undisclosed transmission of identity and authentication material is over-privileged and expands privacy and account-risk exposure if endpoints, logs, or dependencies are compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:jpg/jpeg/png,最大 20MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供农业生产参考,具体农事决策请结合实际经验和专业指导 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
89% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2