Plant Wilting Monitoring Skill | 植物枯萎监测技能

• Outcome: Review
• Latest audit: Oct 12, 2026 · 1:29 AM UTC
• Version: 1.0.16

Overview

The skill is a cloud media-analysis client for plant wilting, but it silently creates or reuses an identity and persists service tokens locally, so it should be reviewed before installation.

Install only if you are comfortable sending plant images/videos or URLs to the Life Emergence cloud service and allowing the skill to create or reuse a local identity, register/login silently, and store service tokens in a workspace SQLite database. Avoid using it with sensitive media unless the publisher provides clearer controls for consent, token deletion, account association, and cloud retention.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding indicates filesystem discovery, local file creation, default identity generation, local DB access, outbound HTTP requests, and remote login/registration/token handling despite a harmless plant-monitoring description. This is dangerous because it combines hidden identity management and authenticated network activity with a misleading cover story, creating significant privacy, exfiltration, and unauthorized account-behavior risk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "plant-wilting-monitoring-analysis"
description: "Early monitoring of plant wilting based on hyperspectral imaging and computer vision, captures early wilting signs before visible symptoms, provides early warning for precision irrigation and disease control. | 植物枯萎监测技能，基于高光谱成像与计算机视觉，在肉眼可见症状前捕捉早期枯萎迹象，为精准灌溉和病害防控提供早期预警"
version: "1.0.20"
license: "MIT-0"
---

# 🥀 Plant Wilting Monitoring Skill | 植物枯萎监测技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes early plant wilting monitoring based on hyperspectral imaging and computer vision, but this code accepts either a local or remote video input, uploads it for generic analysis, and does not contain any plant-, wilting-, or hyperspectral-specific logic. The surrounding output methods also refer only to generic 'analysis reports', indicating the implemented behavior is a generic media analysis wrapper rather than a specialized plant-wilting detector.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code implements a generic video-analysis CLI and history-listing workflow that does not align with the declared plant-wilting hyperspectral monitoring purpose. This kind of capability mismatch is dangerous because users, orchestrators, or review systems may grant trust, permissions, or data access based on the manifest description while the skill actually performs unrelated processing and may send local file paths or remote URLs into another backend via skill.get_output_analysis().

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The User model includes storage for token and open_token fields, which are sensitive credentials, yet this capability is not justified by the plant-monitoring skill context. In an unrelated skill, credential persistence materially raises the risk of secret retention, lateral access, and abuse if the local database is read by other components or exposed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This utility module contains identity resolution, local user persistence, token handling, automatic login/registration, and generalized HTTP request interception logic that are unrelated to plant wilting analysis. In the context of a narrowly scoped imaging skill, this is dangerous because it greatly expands the skill's privileges and enables hidden account and network operations without a clear user-triggered need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code automatically logs in or registers users against an external service using phoneLogin, silent=1, register=1, and generated or recovered identities. This creates external accounts and obtains tokens without clear consent, which can expose users to unauthorized account creation, tracking, and unintended data association.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool/permission scope while the referenced behavior includes shell execution, filesystem access, environment access, and outbound network use. In an agent setting, missing scope declarations increase the chance of unintended or overly broad tool use, making review, sandboxing, and policy enforcement harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The user-facing documentation and operational instructions are effectively presented as Chinese-first interaction, with no explicit statement that users may choose their preferred language for outputs or prompts. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says it 'defaults' to triggering whenever a user provides plant leaf/plant media needing early wilting monitoring, and also on keywords like '叶子发蔫' or '缺水监测'. These are broad natural phrases that may appear in general plant-care conversations, and the file does not clearly define boundaries for when the skill should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The auto-trigger list includes broad phrases such as '显示所有监测报告' and especially the example set later includes '历史报告', which can overlap with ordinary requests to view prior reports without clearly scoping to this specific skill. The description does not provide exclusion conditions or negative examples to prevent unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script resolves an internal user identity implicitly via OpenIdUtil.resolve_current_open_id without clear user-facing disclosure, consent, or necessity tied to the visible CLI workflow. This can create privacy and accountability risks by associating analysis activity with a user identity even when the user did not explicitly provide one, and the hidden --open-id argument further reduces transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The user-facing output header is hardcoded in Chinese ("植物枯萎监测分析结构化结果") with no indication that language selection is configurable or limited to a justified region-specific context. This creates a natural-language policy issue because the skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2