Security audit
Security checks for vulnerabilities and agentic risk
The skill may analyze plant media, but it silently creates or reuses a user identity, stores auth tokens locally, and retrieves remote history, so it needs review before installation.
Install only if you trust the lifeemergence.com backend with uploaded plant images/videos or URLs and with an internal identity linked across sessions. Review whether automatic history retrieval, local SQLite token storage, and silent account/login behavior are acceptable for your workspace.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
The indicated behavior includes filesystem inspection, local file writes, user identity/open-ID resolution, authenticated external requests, and token/login management despite a benign image-diagnosis description. That combination materially expands the attack surface and could expose local data, credentials, and user-linked remote records.
Metadata-poisoning indicators in a skill manifest are suspicious because attackers sometimes hide control characters or deceptive text to interfere with parsers, reviews, or downstream tool behavior. Even if the content appears benign, this kind of obfuscation can be used to smuggle instructions or make the manifest render differently to humans and machines.
---
name: "smyx-plant-nutrient-diagnosis-analysis"
description: "AI-powered plant nutrient deficiency diagnosis from leaf images. Detects leaf color, morphology changes (pale green/yellow-green/purple-red, marginal scorch, interveinal chlorosis) via computer vision, matches against common deficiency symptom databases, and outputs the most likely deficient nutrient element (nitrogen, phosphorus, potassium, iron, magnesium, zinc, etc.) with confidence score. Enables precision fertilization, avoids blind over-fertilization. Scenarios: smart planters, home gardening, agricultural greenhouses, plant factories. | 通过智能花盆、农业大棚或
The implementation behavior materially diverges from the manifest: it accepts video paths/URLs and submits them to a generic analysis workflow instead of a narrowly scoped plant leaf image diagnosis flow. This mismatch can mislead users and integrators into sending unintended data to a broader backend capability, creating a scope-expansion and data-handling risk.
The implementation materially contradicts the declared skill purpose: instead of plant leaf image nutrient diagnosis, it performs video analysis and history listing. This kind of skill/implementation mismatch is dangerous because users and orchestrators may grant inputs, permissions, or trust based on the manifest, while the code executes a different workflow that could exfiltrate data to unintended backends, process the wrong media type, or bypass review assumptions.
The comments, CLI help text, and user-facing output repeatedly describe a video analysis tool, reinforcing the mismatch with the advertised plant nutrient diagnosis skill. Misleading documentation increases the likelihood of incorrect invocation, unsafe operator trust, and improper handling of user data because reviewers and users may not realize the code's actual behavior.
The User model stores identity-linked fields and secrets/tokens such as username, realname, email, token, and open_token, which are not justified by a plant nutrient deficiency diagnosis feature. In this context, collecting and persisting authentication-like material is especially risky because it can enable credential/token theft, cross-feature tracking, and unauthorized account linkage if the local database is exposed.
The HTTP helper does far more than issue requests: it auto-resolves identities, provisions remote user accounts via /sys/phoneLogin, caches tokens, updates local user records, and returns payment-recharge instructions on billing failures. For a plant diagnosis skill, this is an unjustified capability expansion that can silently transmit identifiers and create backend accounts, making the skill materially more dangerous than its stated purpose suggests.
The skill declares no explicit tool or permission scope even though its documented behavior includes shell execution, network access, environment access, and local file read/write. In an agent setting, this weakens containment and makes it easier for the skill to invoke capabilities beyond what users would reasonably expect from a plant-diagnosis workflow.
The manifest presents a leaf-image diagnosis skill, but the documentation also adds cloud history retrieval and report-link output. While not inherently malicious, this undisclosed expansion changes the data-handling model and can expose stored remote records beyond the expected single analysis action.
The skill instructs automatic local saving of attachments without a clear warning or consent flow. In practice, users may believe they are submitting files only for immediate analysis, not for disk persistence, creating avoidable privacy and data-governance risk.
The skill directs automatic cloud API queries for historical reports without clearly warning users that data is being fetched from a remote service. This can surprise users and expose remote data access patterns or records they did not expect the skill to retrieve automatically.
Automatic creation or reuse of internal user identities is unrelated to the stated plant-diagnosis purpose and introduces hidden identity binding. This can silently correlate analyses across sessions and users, exposing history and undermining privacy expectations.
analyze_video accepts pet_type, and the CLI exposes --pet-type choices of cat, dog, and other, then writes to ConstantEnum.DEFAULT__PET_TYPE. This is semantically unrelated to plant nutrient deficiency analysis and indicates the actual code behavior is inherited from a different pet-analysis context rather than matching the manifested plant-specific intent.
The script includes a --list mode that retrieves historical analysis reports tied to an open_id, which expands the skill from single-image nutrient diagnosis into user-history access. Because open_id can be resolved from input and the file exposes reporting functionality not described in the manifest, this creates an unnecessary data access surface and risks unauthorized access to prior analysis records if identity handling is weak elsewhere.
Detected: suspicious.install_untrusted_source