Security audit
Security checks for vulnerabilities and agentic risk
This plant-diagnosis skill sends media to a cloud service as expected, but it also silently handles identity and tokens and the packaged default configuration can transmit them over plaintext HTTP despite claiming HTTPS.
Review before installing. Expect uploaded plant images/videos and history lookups to be sent to a cloud service. Do not use this version with real data or credentials unless the publisher fixes the default HTTP dev configuration, removes or explicitly consents identity/API-key file use, protects or avoids persisted tokens, and replaces payment-skill instructions with a neutral error.
skills/smyx_common/scripts/config-dev.yaml:2Sensitive media, identity data, and authentication credentials are transmitted over plaintext HTTP
skills/smyx_common/scripts/util.py:414Host-agent identity and API-key file contents can be silently registered and disclosed to the remote service
skills/smyx_common/scripts/dao.py:448Reusable access and authorization tokens are stored in plaintext SQLite fields
skills/smyx_common/scripts/util.py:658HTTP 402 responses inject instructions to install and fund a separate payment Skill
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
Automatic user provisioning, token management, local file operations, and workspace discovery go far beyond the manifest’s simple diagnostic framing. These capabilities can expose secrets, create durable identifiers, and transmit user media/data to remote systems without the clear scope declaration expected for safe agent skills.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "plant-nutrition-diagnosis-analysis"
description: "Diagnoses plant nutrient deficiency or excess based on computer vision and plant physiology, outputs targeted fertilization suggestions for precision nutrient management. | 植物营养诊断技能，基于计算机视觉与植物生理学，通过叶片特征诊断氮磷钾及微量元素缺乏或过剩，输出精准施肥建议"
version: "1.0.15"
license: "MIT-0"
---
# 🧪 Plant Nutrition Diagnosis Skill | 植物营养诊断技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询
---
## 🧭 技能概览 | Overview
| 模�
The manifest describes a plant nutrient diagnosis skill based on plant vision and physiology, but the code formats and prioritizes fields named "commonAiResponse" and "healthAiResponse", indicating a generic or health-analysis response schema instead of plant-specific nutrient diagnostics. This is reinforced by the surrounding output/report logic, which treats results as generic analysis reports rather than plant nutrition findings.
The code explicitly requires a local video path or network video URL and sends it as "videoUrl" when remote, which does not match the manifest's description of diagnosing nutrient deficiency/excess from plant visual features. While image input could be plausible for such a skill, video-centric handling is a materially different behavior than the declared plant nutrition diagnosis scope.
The implementation is a generic video-analysis CLI, not a plant nutrient diagnosis skill as declared in the manifest. This mismatch is dangerous because users and higher-level agents may route plant images or agronomy data to a different backend than expected, causing undisclosed data transfer, incorrect outputs, and trust-boundary violations.
This file implements a broad, reusable API client with pagination, CRUD, arbitrary HTTP verbs, and user lookup that goes well beyond a plant nutrient diagnosis skill’s stated purpose. In a skill context, this unnecessary network-capable surface can be repurposed to exfiltrate data, contact attacker-controlled endpoints, or perform unauthorized remote actions if other parts of the skill can influence URLs or payloads.
The add/edit/delete/http_get/http_post/http_put/http_delete methods expose arbitrary remote request capability unrelated to nutrient analysis, creating a powerful primitive for unintended data transfer or command-and-control style behavior. Because the methods accept caller-supplied URLs and arguments, any upstream compromise or misuse could turn this skill into a generic remote access client.
This file defines a persistent user/account model and DAO, including identity fields and token storage, which does not align with a plant nutrition diagnosis skill's stated purpose. Capability mismatch is a strong security concern because it introduces unnecessary data collection and persistence primitives that could be abused for tracking, credential retention, or lateral functionality beyond the declared scope.
The User model stores username, realname, email, birthday, token, and open_token in a local SQLite database. For a plant nutrient diagnosis skill, retaining identity and authentication-like tokens is unjustified and materially increases privacy and credential exposure risk if the workspace is accessed by other skills, agents, or local users.
The code reads identity material from workspace files and silently creates or reuses default user identities when none are supplied. For a plant diagnosis skill, this is unjustified privilege/identity manipulation that can bind user activity to local credentials or auto-generated accounts without informed consent.
This utility file performs authenticated API calls, token management, and account provisioning logic that is unrelated to plant nutrient diagnosis. In the context of a vision-based agronomy skill, this hidden identity and network functionality expands the trust boundary and can cause unauthorized account creation, token use, and remote data transmission without clear user intent.
The skill declares no explicit tool/permission boundaries while instructing use of local files, shell execution, network access, environment/context use, and local persistence. In an agent setting, this broad undeclared capability increases the chance of over-privileged execution and makes it harder for reviewers and runtime policy to constrain risky actions.
The auto-trigger phrases for history queries are broad enough that ordinary requests may unintentionally invoke cloud history retrieval. In an agent context, that can surface sensitive prior reports or cause unexpected network actions without sufficiently clear user intent.
The workflow states that uploaded files or media are automatically saved locally, but this is not prominently disclosed at the point of collection or trigger. Silent local persistence of user media increases privacy and retention risk, especially for images/videos users may expect to be processed transiently.
Detected: suspicious.install_untrusted_source