Plant Nutrition Diagnosis Skill | 植物营养诊断技能

• Outcome: Review
• Latest audit: Aug 27, 2026 · 6:49 PM UTC
• Version: 1.0.11

Overview

This skill can analyze plant images, but it also silently creates or reuses cloud identities, uploads user media, queries cloud history, and stores tokens locally with incomplete disclosure.

Install only if you trust the Life Emergence backend and are comfortable with plant images or URLs being sent to a cloud service, account-linked history being queried, and local workspace data storing identity records and tokens. Before approval, the publisher should disclose permissions, require explicit consent for history/account actions, remove silent registration or token persistence unless essential, use production HTTPS defaults, and document retention/deletion behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 75% confidence
• Finding: The code builds query filters from caller-supplied keys via getattr(self.__model__, key). Although this is not SQL injection because SQLAlchemy still parameterizes values, unvalidated field selection can expose unintended columns for querying and can break authorization assumptions if higher layers pass user-controlled filter dictionaries. In a skill unrelated to account management, generic querying over user records increases privacy risk because it enables broad searching across identity fields.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 72% confidence
• Finding: This count() method repeats the same unvalidated dynamic column selection pattern for filter keys. While not direct injection, it can be abused to probe the existence and distribution of user-account data across arbitrary model fields, which is especially concerning in a skill whose declared purpose is plant diagnosis rather than identity management.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises no explicit permissions while its documented behavior requires shell execution, file reads/writes, network access, and likely environment access. This weakens sandboxing and review because operators and users cannot accurately assess the real capability and data exposure surface before use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is plant nutrient diagnosis, but the documented behavior expands into account initialization, token acquisition, local identity persistence, and historical report retrieval. That mismatch obscures sensitive backend interactions and data handling, making it easier to smuggle in tracking, account linkage, or unrelated remote operations under an innocuous description.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation broadens the skill from image diagnosis to cloud history querying and report-link retrieval, increasing the data-access scope beyond what users would reasonably expect. This creates privacy and authorization risk because a diagnosis skill can become a portal into prior records and cloud-hosted artifacts.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Automatic identity initialization, reuse of a local default user, and silent account association are unnecessary for basic image diagnosis and create hidden state tied to a user profile. This can cause cross-session data leakage, unintended account correlation, and unauthorized access to historical reports if the local default identity is reused incorrectly.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The privacy statement claims no plaintext PII is stored, yet the workflow references username/phone-based identity parameters and local user reuse/creation. This inconsistency is dangerous because reviewers and users may rely on privacy claims that do not match actual identity-processing behavior.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill includes a history-listing feature that is not necessary for plant nutrient diagnosis and can expose prior analysis records tied to a user identity. In a narrowly scoped image-diagnosis tool, unrelated data-access functionality increases attack surface and creates a privacy risk if users can retrieve historical results without explicit authorization and disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code resolves an internal user identity (`open_id`) even though the advertised purpose is plant nutrition diagnosis from an image. Binding a hidden identity mechanism to an apparently simple diagnostic CLI creates undisclosed collection and account-linkage behavior, and could enable access to user-scoped data such as analysis history without the user's informed awareness.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file’s behavior materially contradicts the declared skill purpose: instead of plant nutrient diagnosis, it implements a generic video-analysis and history-listing client. This is dangerous because a mismatched skill can hide unexpected capabilities, route user data to unrelated backends, and undermine trust and review controls that depend on accurate manifests.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The inline documentation and CLI strings repeatedly describe a video analysis tool, reinforcing that the skill does something different from its advertised plant-diagnosis role. While largely documentary on its face, this inconsistency increases the likelihood of operator deception, misuse, and accidental exposure of user-provided files or URLs to an unintended analysis service.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file implements a broad generic network/API wrapper with CRUD-style operations and arbitrary URL request methods that are not clearly required for a plant nutrition diagnosis skill. In this context, such unrelated capability expands the skill's attack surface, enables hidden data exfiltration or remote command-and-control style communication, and makes it harder to verify that outbound requests are limited to legitimate plant-analysis functions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The presence of a user-account lookup method is unjustified for a plant nutrition diagnosis skill and introduces access to identity-related data unrelated to the stated function. Even if not overtly malicious, this creates unnecessary privacy and reconnaissance risk because the skill could enumerate or query users without a clear plant-care use case.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The configuration class reads user and platform-specific environment variables such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID even though this file is part of a plant nutrition diagnosis skill. This creates unnecessary access to identity/context data and expands the data boundary of the skill, which can enable unintended collection, propagation, or misuse of unrelated user metadata if other components consume these values.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file defines a reusable DAO for user-account records, including default-user lookup logic, which is unrelated to plant nutrient diagnosis. Capability mismatch is a strong indicator of unnecessary privileged functionality: if compromised or misused, the skill can persist and retrieve user identity data far outside its stated scope, increasing attack surface and data-handling risk.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores usernames, real names, email, birthday, and especially token/open_token fields, none of which are justified by a plant nutrition diagnosis workflow. Persisting identity and bearer-token material creates a direct confidentiality risk: database disclosure or lateral access to the local file could expose credentials and personal data.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This utility file implements generalized identity resolution, token management, local user persistence, remote account provisioning, and authenticated API transport that are far broader than a plant nutrition diagnosis skill needs. That mismatch is dangerous because it creates hidden account, tracking, and network side effects in a domain-specific skill, increasing the chance of undisclosed data handling and misuse of user context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can silently call a remote /sys/phoneLogin endpoint with register=1 and silent=1 to create or recover an account using a generated or derived username/openId. Silent account provisioning unrelated to the declared skill purpose is risky because it can establish backend identities and tokens without informed user action, enabling tracking, billing linkage, or unauthorized use of external services.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill reads identity material from workspace data/smyx-api-key.txt, falls back to local database records, and creates a persistent default user when none exists. Persistent identity creation and reuse are not justified by the manifest's plant diagnosis function and can enable undisclosed user correlation across runs and skills.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code contains a recharge/payment upsell flow triggered by HTTP 402 responses, instructing users to install a payment skill and top up an account. This is unrelated to plant nutrient diagnosis and indicates the skill may participate in monetized platform behavior not disclosed by the manifest, which increases social-engineering and unauthorized-billing risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Overly broad trigger phrases for historical report retrieval can cause the skill to access cloud records when a user did not intend to request account-linked history. In a skill that silently handles identity and remote queries, ambiguous triggering raises the chance of unintended data disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states uploaded files and images may be automatically saved locally without a clear front-facing warning or retention policy. Local persistence of user media increases exposure to sensitive data leakage, especially when combined with identity association and cloud reporting workflows.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script initializes internal identity resolution in a hidden way (`argparse.SUPPRESS` and comment indicating it is not shown to users), which prevents users from understanding that account context may be attached to their action. Hidden identity handling is dangerous because it undermines transparency and can facilitate covert data association, tracking, or retrieval of account-linked records.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill accepts arbitrary local file paths or remote URLs and forwards the file contents or URL to an external analysis service without any user-facing consent, privacy notice, or visible restriction to the declared domain. In a skill context, this can cause unintended exfiltration of sensitive local files or user-supplied remote resources, especially because the implementation reads and uploads the entire file after only extension and size checks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Debug mode enables urllib3/http.client verbose logging around authenticated HTTP activity. Even though some manual printing truncates headers later, lower-level debug logging can still expose request metadata and possibly tokens, identifiers, or sensitive payloads in logs without user awareness.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2