Plant Wilting Monitoring Skill | 植物枯萎监测技能

• Outcome: Review
• Latest audit: Aug 26, 2026 · 4:40 PM UTC
• Version: 1.0.12

Overview

The skill can perform the advertised plant media analysis, but it also silently manages account identity, stores tokens locally, and defaults to non-HTTPS dev endpoints.

Review this before installing. It is not just a local plant-image checker: using it can upload media or URLs to a remote service, automatically create or reuse an account identity, store tokens in the workspace data area, and query cloud history. Install only if you trust the publisher and are comfortable with those account and data-transfer behaviors; ask for HTTPS production endpoints, explicit permissions, and a way to clear stored identity/token state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 75% confidence
• Finding: This method accepts filter keys and directly resolves them with getattr(self.__model__, key) without validating that the key is an allowed column. If untrusted input reaches filters, an attacker can trigger attribute errors for denial of service or query against unintended model attributes, creating an unsafe query surface and possible authorization bypass depending on callers.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 75% confidence
• Finding: The count() method repeats the same pattern of resolving unvalidated filter keys via getattr() on the model. If filters are influenced by user input, this can cause crashes or expose unintended query behavior, especially in generic DAO code reused across multiple skills.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and documents code-capable behavior including shell execution, local file handling, network access, and possible environment use, yet no explicit permissions are declared. This weakens user and platform transparency and can enable unexpected access to local files or remote services without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes beyond plant-wilting analysis into identity creation/reuse, token acquisition, local persistence, and historical report retrieval. This mismatch is dangerous because users may provide files expecting narrow image analysis, while the skill performs account-linked remote operations and stores identifiers locally, increasing privacy and abuse risk.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The privacy section claims internal identifiers are not stored in directly identifiable plaintext, while the workflow indicates a local default user may be reused or created for future tasks. Such persistent local identity linkage can expose users to unintended tracking, cross-session correlation, or leakage if storage protections are weak or undocumented.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script initializes an internal identity context and exposes a hidden analysis-listing path that is not necessary for single-image plant wilting analysis. In a skill whose stated purpose is image-based plant health assessment, undisclosed identity resolution and history access expand the attack surface and can enable unauthorized access to prior analysis data if upstream controls are weak.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a plant wilting analysis tool, but the code also provides an analysis-history retrieval capability through show_analyze_list(). This mismatch is security-relevant because users and reviewers may not expect data-enumeration behavior, and such hidden functionality can expose prior user data or operational metadata.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill accepts arbitrary remote HTTP/HTTPS URLs and forwards them to backend analysis without visible allowlisting or purpose restriction. If the backend fetches these URLs server-side, this can enable abuse such as internal network probing, access to sensitive endpoints, or processing of attacker-controlled content outside the stated plant-monitoring context.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation materially contradicts the declared skill purpose: a plant wilting / hyperspectral monitoring skill actually performs generic video analysis and history listing through shared backend helpers. This kind of scope mismatch is dangerous because users, policy engines, or reviewers may grant the skill permissions and trust based on its manifest while the code enables broader data processing and access patterns than expected.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comments, CLI text, and docstrings consistently describe a generic video analysis tool, which conflicts with the manifest's specialized agricultural/hyperspectral claim. This inconsistency increases the risk of deceptive packaging, mis-scoped deployment, and accidental exposure of broader functionality under a trusted domain-specific label.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This module exposes a generic API client with arbitrary URL-based POST/PUT/GET/DELETE operations and generic CRUD helpers that are not constrained to plant-wilting analysis functions. In the context of a narrowly scoped monitoring skill, this overbroad network and data-manipulation capability enables the skill to access or modify unrelated remote resources if other components can influence the URL or payloads.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The presence of generic add, edit, delete, and raw HTTP mutation methods gives the skill the ability to modify or delete remote resources without any domain-specific restriction. For an early wilting monitoring skill, such write/delete capabilities are unjustified and increase the risk of unauthorized state changes, data tampering, or destructive actions against backend systems.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This file stores user identity and token data (username, realname, email, token, open_token) in a plant-wilting monitoring skill where such data handling is not obviously necessary. That mismatch increases the risk of unnecessary collection and persistence of sensitive data, broadening the attack surface and privacy impact if the local database is accessed.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The shared module exposes a generic ai_chat/agent-invocation interface that is not aligned with the advertised plant-wilting monitoring purpose. Even though the subprocess call is currently commented out, leaving a general-purpose agent execution pathway in a shared skill increases attack surface and creates a clear capability mismatch that could later be enabled or reused in unintended contexts.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This code introduces a general agent-execution abstraction unrelated to hyperspectral imaging or wilting analysis, which is a security-relevant design issue because hidden or unnecessary execution features are often abused as backchannels. In the context of a domain-specific skill, unjustified agent orchestration is more suspicious and broadens the module's effective privileges beyond user expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility contains authenticated API request handling, token management, user lookup, auto-login/registration, and payment-related behavior that is unrelated to plant-wilting analysis. In the context of a hyperspectral plant-monitoring skill, this hidden identity and account orchestration greatly increases the risk of undisclosed data transmission and abuse of the host environment for unrelated platform operations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code resolves an open-id from local files, local database records, or generates a new identity and persists it for future reuse. For a plant-monitoring skill, silently creating or reusing identities and storing credential-like state is dangerous because it enables tracking, impersonation, and unauthorized account linkage without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code returns hardcoded recharge/install instructions for a payment skill when a remote service reports insufficient balance. This is unrelated to plant-wilting analysis and indicates the skill may steer users into financial/account workflows not expected from its stated purpose.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases for history-report retrieval are broad enough that ordinary conversation could invoke cloud history access unintentionally. In this skill context, that is more dangerous because history queries appear account-linked and remote, so accidental activation may disclose prior analysis metadata or reports without clear user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow indicates local files and remote URLs are sent to a cloud API, but the main skill description does not clearly warn users of this data transfer at the point of use. This is dangerous because uploaded images, videos, and URLs may contain sensitive agricultural, location, or proprietary operational data that users did not realize would leave the local environment.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code accepts a suppressed --open-id parameter and resolves internal identity without clear user-facing disclosure. Hidden identity-affecting parameters are risky because they can facilitate impersonation, confusing privilege context, or unauthorized data access, especially when paired with the list functionality.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The code reads local file contents and uploads them, or forwards a remote URL for analysis, without any visible consent, disclosure, or warning in this layer. In an agent setting, this can cause unintended exfiltration of sensitive local media or transmission of third-party URLs to external services, especially since the skill description does not clearly communicate such behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically attaches user identifiers and authentication tokens to outbound HTTP requests, and may also add tenant and platform metadata. Without clear disclosure or strict purpose limitation, this creates a privacy and security risk because sensitive identity material can be transmitted to external services during ordinary skill use.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The utility reads an identity value from data/smyx-api-key.txt and treats it as an internal open-id source without any user-facing disclosure. Accessing local credential-like data in a skill unrelated to authentication expands trust boundaries and can silently appropriate local secrets or identifiers.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This request posts identity data such as openId and mobile to a remote phoneLogin endpoint to create or fetch a user account. In a plant-monitoring skill, external transmission of identity-related data is especially suspicious because it is not necessary for the core agricultural analysis function and may expose users to tracking or unauthorized registration.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2