Farming Assistance for Allotments

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:30 PM UTC
• Version: 1.0.2

Overview

The skill mostly matches garden-management use, but it can make automatic local knowledge-base changes and send garden reports externally with insufficient disclosure and control.

Before installing, be comfortable with the skill writing local garden memory files and sending your coordinates to Open-Meteo for weather. Review or disable the weekly Telegram report path unless you explicitly want OpenClaw broadcasts to configured recipients. Do not rely on the automatic unknown-crop flow without reviewing generated crop knowledge first.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if dry_run:
        command.append("--dry-run")
    try:
        completed = subprocess.run(command, capture_output=True, text=True, check=False)
        return {
            "date": report["date"],
            "type": "weekly_report_delivery",

• Confidence: 88% confidence
• Finding: The code invokes an external program, `openclaw`, to send a Telegram broadcast using message content and recipient targets derived from local state. Although `subprocess.run()` is used with a list rather than a shell, this still grants the skill an external execution and data exfiltration capability that can transmit garden data to arbitrary configured recipients.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill exposes shell, file read/write, and network-capable behaviors but does not declare permissions or present a clear trust boundary. That makes it harder for a host system or reviewer to apply least-privilege controls and increases the chance that broad capabilities are exercised unexpectedly through normal garden-related prompts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description frames the skill as local garden management, but the documented behavior includes sending weekly reports/messages to Telegram recipients via an external messaging tool. Hidden communication features create a significant trust and exfiltration risk because users may invoke a seemingly harmless gardening skill without realizing it can transmit data externally.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The unknown-crop flow instructs the agent to create and populate knowledge-base files from its own training knowledge without user approval. This is dangerous because it authorizes hidden file creation and persistent data modification based on model-generated content, which may be inaccurate, unreviewed, or manipulable through user input.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill contains conflicting instructions: it says never modify crop knowledge unless the user explicitly asks, yet later mandates automatic KB modification for unknown crops. Contradictory safety rules are dangerous because they undermine operator expectations and can cause silent persistent changes even when the user did not authorize knowledge-base edits.

Context-Inappropriate Capability

High

• Confidence: 83% confidence
• Finding: The skill executes an external binary to deliver reports, which expands its privileges beyond pure local garden planning logic. Even if intended for notifications, this creates a trust boundary crossing where local garden data is handed to another executable whose behavior, configuration, and security properties are outside this code's control.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: Telling the agent to always assume gardening questions are about the user's allotment broadens trigger scope and can cause the skill to take garden-management actions for generic or hypothetical gardening discussions. In a stateful skill with write and network capabilities, over-broad activation increases the chance of unintended side effects.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Several listed triggers are common phrases that can appear in casual conversation without clearly signaling intent to modify garden state or send reports. Because the skill also supports writes and outbound messaging, ambiguous trigger phrases raise the risk of accidental invocation and follow-on actions in the wrong context.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description does not warn users that unknown-crop handling can create and modify files automatically. Undisclosed persistent side effects are dangerous because users cannot make informed decisions about whether a simple planting request may trigger hidden local data mutations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function sends a compiled weekly report to all enabled Telegram recipients without any runtime confirmation, warning, or per-send authorization. Because the report includes garden status, crop names, schedules, and possibly location-derived context, users may unknowingly disclose personal activity data to unintended recipients if recipients are misconfigured or maliciously altered.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The unknown-crop flow authorizes a chain of hidden actions: scaffold file creation, model-authored edits, repeated validation fixes, and KB insertion, all without user approval. Incremental autonomous writes are dangerous because each retry expands the window for unintended persistence, bad data, or abuse through crafted crop names and follow-up prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Run `scaffold-kb-crop --plant-id <plant_id> --lifecycle <annual/perennial> --file data/<plant_id>_scaffold.json` to get a template file in the data folder.
2. Read the template file, then rewrite/populate it with accurate botanical and watering details from your training knowledge.
3. Automatically run `add-kb-crop --from-file data/<plant_id>_scaffold.json --json`. (This will also automatically delete the scaffold file from the data folder on success).
4. If `add-kb-crop` returns any validation errors, fix the fields in the file and retry.
5. Once the crop is successfully added to the knowledge base, immediately re-run the original `add-planted-crop` command, but only if the user intended to actually add the crop.
6. Once completed, present the final success message to the user, informing them that the crop was automatically added to the knowledge base and successfully planted.

• Confidence: 88% confidence
• Finding: The instruction to automatically scaffold, populate, validate, and add a crop entry delegates meaningful autonomous decision-making to the agent for persistent state changes. In this context, autonomy is risky because the model is deciding content and retry behavior without human review, which can produce incorrect records or unauthorized local modifications.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Run `scaffold-kb-crop --plant-id <plant_id> --lifecycle <annual/perennial> --file data/<plant_id>_scaffold.json` to get a template file in the data folder.
2. Read the template file, then rewrite/populate it with accurate botanical and watering details from your training knowledge.
3. Automatically run `add-kb-crop --from-file data/<plant_id>_scaffold.json --json`. (This will also automatically delete the scaffold file from the data folder on success).
4. If `add-kb-crop` returns any validation errors, fix the fields in the file and retry.
5. Once the crop is successfully added to the knowledge base, immediately re-run the original `add-planted-crop` command, but only if the user intended to actually add the crop.
6. Once completed, present the final success message to the user, informing them that the crop was automatically added to the knowledge base and successfully planted.

• Confidence: 88% confidence
• Finding: The instruction to automatically scaffold, populate, validate, and add a crop entry delegates meaningful autonomous decision-making to the agent for persistent state changes. In this context, autonomy is risky because the model is deciding content and retry behavior without human review, which can produce incorrect records or unauthorized local modifications.

Static analysis

No suspicious patterns detected.