Back to skill

Security audit

Plant Vitality Index | 植物整体活力指数(综合评分)

Security checks across malware telemetry and agentic risk

Overview

The skill does plant-related cloud analysis, but it also silently creates or reuses a local identity and stores account tokens, which users should review before installing.

Install only if you are comfortable with plant images or videos and report history being sent to the configured lifeemergence.com cloud services. Review the local identity behavior first: the skill can create/reuse a workspace user, read data/smyx-api-key.txt as an identity value, and store returned tokens in a local SQLite database.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (38)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions while instructing use of local file access, local file saving, shell execution, environment use, and network/API communication. This is dangerous because it conceals the real trust boundary from reviewers and users, increasing the chance that sensitive local data is accessed or transmitted without informed approval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is narrow plant-vitality scoring, but the described behavior extends to remote API submission, automatic identity/auth handling, local token/user storage, report listing, and export-link generation. Such description-behavior mismatch is dangerous because users may consent to simple analysis while the skill actually performs broader data processing and account-linked cloud operations.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill claims to score vitality and report a trend, but also documents cloud history querying, report-link generation, and report retrieval workflows. This scope expansion is risky because it introduces additional data access paths and possible exposure of prior reports beyond what a user would expect from a simple scoring tool.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Automatic cloud API access and mandatory historical report retrieval are not necessary for computing a vitality score from current plant inputs. This increases the attack surface by causing remote data access and possible account data disclosure whenever broad trigger conditions are met.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill automatically reuses or creates a local default user identity and associates reports to that identity without explicit user awareness. This is dangerous because it can mix data across sessions or users, create hidden account state, and expose or misattribute historical reports and tokens stored on the system.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The AI role says the skill should only output a score and trend, but other sections permit suggestions, alerts, risk prompts, and report links. This inconsistency matters because it weakens policy boundaries and can be used to justify broader actions or outputs than the user expects.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script’s interface and behavior do not align with the declared plant-vitality purpose: it accepts a pet_type argument, mutates a global pet-type default, and exposes list retrieval by open_id. This kind of semantic mismatch is dangerous because it can route data into the wrong backend logic or expose unrelated user-scoped records, increasing the chance of unauthorized data access or cross-context processing errors.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The comment claims the tool initializes an internal identity without user input, but the code may use a caller-supplied open_id. That discrepancy can mislead reviewers and operators, and if downstream access control trusts CURRENT__OPEN_ID, a supplied identifier could cause retrieval or attribution under the wrong user context.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation accepts arbitrary video files or remote video URLs and submits them for generic analysis, which materially diverges from the manifest describing plant vitality scoring from plant-monitoring inputs. This kind of scope mismatch is dangerous because users, reviewers, or policy controls may permit the skill under a narrow plant-analysis description while the code actually provides a broader media-processing capability that could be abused for unreviewed data ingestion or exfiltration workflows.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill exposes report-listing and export-link generation features that are not disclosed in the manifest, expanding capability beyond the stated plant vitality scoring function. Hidden or undocumented retrieval features are risky because they can expose prior analysis metadata or report artifacts to callers who only expect a single-purpose scoring tool.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file’s behavior materially contradicts the declared skill purpose: instead of plant-vitality analysis, it implements generic video analysis and history listing. This kind of capability mismatch is dangerous because users and reviewers may grant permissions or trust based on the manifest, while the code performs different data-handling actions, enabling deceptive collection or transmission of unrelated content.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
User-facing strings and CLI help repeatedly describe a video analysis tool, which directly conflicts with the plant-vitality skill description. This inconsistency increases the likelihood of deceptive use or accidental misuse, because operators may not understand what data is actually being processed and sent to backend services.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file exposes a broad generic API wrapper, including add, edit, delete, and arbitrary http_get/http_post/http_put/http_delete methods, which materially exceeds the stated plant vitality analysis purpose. In a skill that should mainly read sensor/image data and compute scores, these primitives enable arbitrary remote actions if reachable by higher-level code, increasing the risk of unauthorized data modification, exfiltration, or abuse of connected services.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The add, edit, and delete methods provide direct remote resource modification capability without any visible restriction, policy enforcement, or indication that such actions are necessary for plant vitality scoring. Because the manifest describes a read/compute analysis skill, these write paths are contextually suspicious and could be abused to alter or destroy remote records if invoked by the agent or chained code.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
YamlUtil.load() creates missing directories and writes a new config file as a side effect of a read-style operation. In a skill described as plant vitality analysis, unexpected filesystem mutation violates least surprise and can alter host state, especially if the path is influenced by deployment layout or shared modules.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The module reads user-identifying environment variables such as OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID even though they are unrelated to plant vitality scoring. This expands data access beyond functional necessity and can expose or propagate identity data through shared state if other components later log or transmit these values.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This plant-vitality skill includes a shared DAO for generic user/account management, which is unrelated to the stated function of evaluating plant health. The mismatch expands the attack surface and suggests the skill can access or manipulate identity data beyond what is necessary, violating least-privilege expectations for this context.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores authentication-like tokens plus personal profile data such as real name, email, birthday, age, and sex, despite the skill being described as plant vitality analysis. In this context, collecting and persisting such data is unnecessary and dangerous because compromise of the local SQLite database would expose credentials and sensitive personal information unrelated to the skill’s purpose.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility code performs generic authenticated network operations, token handling, and even remote account provisioning that are far broader than the declared plant-vitality analysis purpose. In the context of a narrowly scoped analysis skill, this creates hidden external side effects and allows user/identity data to be transmitted to backend services without clear necessity or disclosure.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code reads identity material from a local file and silently falls back to creating persistent default user identities in a local database. That behavior is unrelated to plant scoring and can cause unauthorized identity reuse, implicit account creation, and confusing attribution of actions performed by the skill.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workspace-detection helpers expose generalized filesystem discovery and directory creation behavior unrelated to plant analysis. While not inherently malicious, this broadens the skill's operating scope and can enable unintended access to agent workspaces or persistence locations if later combined with other file operations.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring describes reading an API key file, but the implementation uses the file contents as an internal/open identity value. This semantic mismatch can lead operators to place highly sensitive credentials in a file that the code then repurposes for identity selection, increasing the chance of misuse, misconfiguration, and accidental credential exposure.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The default trigger is broad enough to activate on many ordinary plant-analysis requests and uploaded media without clear boundaries. Overbroad triggering is dangerous because it can cause unintended local file saving, network submission, or historical cloud queries when the user did not specifically request those actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2