Plant Night Respiration Rate Analysis | 植物夜间呼吸作用强度估算

• Outcome: Review
• Latest audit: Jul 31, 2026 · 3:06 PM UTC
• Version: 1.0.5

Overview

This skill can analyze plant imagery, but it also silently creates or reuses an identity, contacts cloud services, and stores account tokens locally.

Review this skill before installing if you are not comfortable sending plant images/videos or supplied URLs to lifeemergence.com services. Treat it as an account-backed cloud tool: it may create or reuse a local identity, retrieve identity-linked history, and store service tokens in a workspace SQLite database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The manifest describes shell, network, file read/write, and environment-variable capable behavior without any declared permission model or user-facing constraints. That creates a trust and containment gap: users may believe this is a narrow plant-analysis skill, while the documented workflow can invoke local scripts, access files, and send data to remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to estimate plant respiration from thermal imagery, but the documented behavior expands into hidden account initialization, token management, local identity persistence, cloud history retrieval, and report-link generation. This mismatch is dangerous because it conceals sensitive data processing and backend interactions that a user would not reasonably expect from the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The implementation materially diverges from the declared skill purpose: instead of performing plant nighttime respiration analysis from thermal imagery and optional CO₂ data, it exposes a generic video-analysis entry point and history-listing behavior. This kind of skill/implementation mismatch is dangerous because it can mislead reviewers and users about what data is being processed and what backend capabilities are invoked, enabling unauthorized data exfiltration, unintended remote processing, or use of the skill as a disguised generic media-analysis wrapper.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The user-facing CLI text and documentation describe a generic video analysis tool, which contradicts the plant-respiration skill metadata and increases the likelihood of operator confusion and misuse. In a security review context, deceptive or inconsistent labeling is risky because it obscures the true function of the code, weakens informed consent around data handling, and can hide broader backend capabilities than users expect from an agricultural analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This file exposes generic CRUD and arbitrary HTTP wrapper methods that are not scoped to the stated plant respiration analysis purpose. In an agent-skill context, such broad remote-call capability can be repurposed to interact with unintended internal or external services, expanding the attack surface and enabling misuse beyond the declared functionality.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The implementation is a general-purpose remote API client rather than logic specific to thermal/CO2-based plant respiration analysis. This mismatch between declared purpose and actual capability is dangerous because it can conceal broad networking behavior inside a narrowly described skill, making review, policy enforcement, and user trust assumptions less reliable.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file defines generic user/account persistence, including a User model and UserDao, despite the skill being for plant night-respiration analysis. Unrelated identity/account storage expands the data-collection and attack surface without apparent functional need, increasing the chance of unnecessary retention, misuse, or exposure of user data.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The schema stores authentication-style tokens along with personal profile data such as username, real name, email, birthday, sex, and age, none of which are justified by a plant respiration analysis workflow. If the local SQLite database is accessed by another component or exfiltrated, these fields could expose credentials and sensitive personal information far beyond the skill's stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This shared utility performs token management, remote account provisioning, and authenticated API access that are unrelated to nighttime plant respiration estimation. Because it can automatically create identities, fetch/store tokens, and transmit them in requests, it expands the skill's behavior far beyond its declared purpose and creates covert data egress and account abuse risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code resolves an internal identity from local files, reuses database users, or generates a new default user identifier without user action, then later uses that identity for remote login/provisioning. For a plant-respiration analysis skill, silent identity creation and reuse is unjustified and dangerous because it can bind user activity to hidden accounts and enable backend access without informed consent.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The auto-trigger phrases for historical report queries are broad enough to activate cloud-history retrieval for generic requests about reports, which can cause unintended access to prior records. In a skill that also auto-associates hidden user identity, overly broad triggering increases the chance of accidental data disclosure or execution of network actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to provide local files or URLs and states that the API service will download network resources, but it does not clearly warn that submitted content may be transmitted to a cloud/backend service. This creates a privacy and data-handling vulnerability because sensitive local imagery, videos, or internal URLs may be sent off-device without informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code resolves an internal user identity through OpenIdUtil.resolve_current_open_id with the parameter hidden from help output, which creates undisclosed identity handling. Hidden identity binding can enable silent attribution, access to another user’s analysis history, or privacy violations if the utility derives identity from ambient context without explicit user consent.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The function reads a local file into memory or accepts a remote URL, then submits that data to an external analysis service without any visible user-facing disclosure, consent check, or trust-boundary warning in this code path. In a skill that may process camera-derived imagery, this creates a privacy and data-governance risk because users may unintentionally transmit sensitive operational or environmental data off-device.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The delete method performs a state-changing remote request through a generic wrapper without any visible safeguards such as confirmation, authorization checks, endpoint restriction, or intent validation. In an agent environment, this can enable unintended or unauthorized destructive actions against remote systems if the method is reachable with attacker-controlled parameters.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Enabling urllib3/http.client debug logging can expose full HTTP request and response metadata, potentially including tokens, identifiers, and payload contents. In this codebase, that risk is amplified because the same utility handles authentication headers and remote login flows, so debug mode may leak sensitive operational data to logs without user awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The utility silently creates or reuses a persistent user identity, including writing/reading from local state, without any disclosure or consent flow. This is dangerous because users of a plant-monitoring skill would not reasonably expect account creation, identity persistence, or linkage of activity to a hidden backend identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The network request path automatically injects usernames, app identifiers, tokens, tenant codes, and platform metadata into outbound requests without explicit user disclosure. In a skill whose stated function is thermal/CO2 plant analysis, this hidden transmission is unexpected and increases privacy, tracking, and unauthorized backend interaction risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 jpg/png 热成像图像或 mp4/avi/mov 视频，最大 10MB；建议在夜间无光照时段采集 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供科研/养护参考，不替代专业农业仪器测量 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 78% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-plant-night-respiration-rate-analysis"
description: "In a plant factory, a fixed thermal imaging camera continuously captures thermal images of the plant canopy leaves at night (no-light period), analyzes leaf temperature trends (respiration releases heat, causing leaf temperature to be slightly higher than air temperature), and combined with optional ambient CO₂ sensor data (respiration releases CO₂ raising concentration), an AI model estimates the relative respiration. | 通过植物工厂内的固定热成像摄像头，在夜间（无光照时段）连续采集植物冠层叶片的热图像，分析叶片温度变化趋势（呼吸作用释放热量导致叶片温度略高于气温），结合可选的环境CO₂传感器数据（呼吸作用释放CO₂浓度升高），利用AI模型估算整株或群体的呼吸强度相对值（0-100%）。"
version: "1.0.7"
license: "MIT-0"
---

• Confidence: 72% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2