Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent garden assistant, but it includes under-scoped persistent automation, external Telegram delivery, and automatic knowledge-base writes that users should review before installing.
Review and constrain this skill before installing. It will maintain local garden memory files, call Open-Meteo with your coordinates, and may send weekly garden reports to configured Telegram recipients. Pay particular attention to the unknown-crop flow, because it can add generated crop facts to the persistent knowledge base without asking you to review them first.
The declared purpose focuses on garden management, but the behavior includes outbound messaging to Telegram recipients and subprocess-based delivery. This is a materially stronger capability than described, so users may authorize the skill without understanding it can send external communications or manage recipient data.
The unknown-crop flow tells the agent to generate and rewrite knowledge-base files using its own training knowledge, then persist those changes without user review. This enables unverified autonomous content creation in a writable local store, which can corrupt data, introduce unsafe guidance, or be abused by crafted user input to cause unauthorized state changes.
The skill exposes shell, file read/write, and network-capable behavior but does not declare any explicit tool scope or permission boundary. That makes the effective privilege set implicit and broader than users or reviewers can easily verify, increasing the chance of misuse or unexpected side effects.
The skill instructs the agent to create scheduled tasks in the harness, which extends its reach from garden advice into persistent automation. A scheduled action can keep invoking network and messaging behavior after the initial interaction, creating ongoing effects the user may not fully anticipate.
The skill directs automatic knowledge-base modification with no confirmation or user-facing warning. Silent persistence is dangerous because it hides lasting state changes from the user and makes it harder to detect accidental or malicious data poisoning.
The instructions encourage the agent to absorb crop details into the knowledge base using model knowledge rather than a trusted source or reviewed input. In this context, that creates a silent data integrity risk: future recommendations, reminders, and watering plans may be based on fabricated or incorrect agronomic data.
The skill explicitly authorizes autonomous multi-step actions: generating files, retrying on validation errors, and re-running planting commands. This reduces user control over state-changing behavior and can compound mistakes across file writes and subsequent actions.
1. Run `scaffold-kb-crop --plant-id <plant_id> --lifecycle <annual/perennial> --file data/<plant_id>_scaffold.json` to get a template file in the data folder.
2. Read the template file, then rewrite/populate it with accurate botanical and watering details from your training knowledge.
3. Automatically run `add-kb-crop --from-file data/<plant_id>_scaffold.json --json`. (This will also automatically delete the scaffold file from the data folder on success).
4. If `add-kb-crop` returns any validation errors, fix the fields in the file and retry.
5. Once the crop is successfully added to the knowledge base, immediately re-run the original `add-planted-crop` command, but only if the user intended to actually add the crop.
6. Once completed, present the final success message to the user, informing them that the crop was automatically added to the knowledge base and successfully planted.
The skill explicitly authorizes autonomous multi-step actions: generating files, retrying on validation errors, and re-running planting commands. This reduces user control over state-changing behavior and can compound mistakes across file writes and subsequent actions.
1. Run `scaffold-kb-crop --plant-id <plant_id> --lifecycle <annual/perennial> --file data/<plant_id>_scaffold.json` to get a template file in the data folder.
2. Read the template file, then rewrite/populate it with accurate botanical and watering details from your training knowledge.
3. Automatically run `add-kb-crop --from-file data/<plant_id>_scaffold.json --json`. (This will also automatically delete the scaffold file from the data folder on success).
4. If `add-kb-crop` returns any validation errors, fix the fields in the file and retry.
5. Once the crop is successfully added to the knowledge base, immediately re-run the original `add-planted-crop` command, but only if the user intended to actually add the crop.
6. Once completed, present the final success message to the user, informing them that the crop was automatically added to the knowledge base and successfully planted.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
RECIPIENTS_PATH = DATA_DIR / "telegram_recipients.json"
WATERING_DETAIL_LOG_PATH = DATA_DIR / "watering_detail_log.json"
OPEN_METEO_URL = "https://api.open-meteo.com/v1/forecast"
FORECAST_DAYS = 7
RAIN_SKIP_THRESHOLD_L_PER_M2 = 1.0
# Three watering tiers matched to root depth. A "surface watering" keeps the seedbed
The send-weekly-report path can transmit weekly garden reports to configured Telegram recipients without any interactive confirmation or warning in this code path. That creates a privacy and safety issue because potentially sensitive location, schedule, or activity information can be sent externally based solely on stored configuration, which is riskier in this skill context than a purely local garden assistant.
The skill includes an external broadcast capability that sends content to Telegram via an out-of-process CLI, expanding its authority beyond garden-state computation into data exfiltration/messaging. In a garden-management skill, this is contextually more dangerous because recipient targeting and outbound transmission are not essential to core local planning logic, so compromise or misuse could leak garden/profile data or enable unauthorized messaging.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if dry_run:
command.append("--dry-run")
try:
completed = subprocess.run(command, capture_output=True, text=True, check=False)
return {
"date": report["date"],
"type": "weekly_report_delivery",