smyx-plant-nutrient-diagnosis-analysis@1.0.16
CAUTION· static onlyPublisher claims: "AI-powered plant nutrient deficiency diagnosis from leaf images. Detects leaf color, morphology changes (pale green/yellow-green/purple-red, marginal scorch, interveinal chlorosis) via computer vision, matches against common deficiency symptom databases, and outputs the most likely deficient nutrient element (nitrogen, phosphorus, potassium, iron, magnesium, zinc, etc.) with confidence score. Enables precision fertilization, avoids blind over-fertilization. Scenarios: smart planters, home gardening, agricultural greenhouses, plant factories. | 通过智能花盆、农业大棚或手机拍摄的植物叶片高清图像，利用AI视觉分析技术识别叶片颜色、形态变化（如叶色浅绿/黄绿/紫红、叶缘焦枯、叶脉间失绿等），与常见营养缺乏症特征库比对，输出最可能缺乏的营养元素（氮、磷、钾、铁、镁、锌等）及置信度。有助于精准施肥，避免盲目用肥造成浪费或伤害。应用场景：智能花盆、家庭园艺、农业大棚、植物工厂。" Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-12 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Hidden zero-width characters detected. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
| 🧑⚖️ 结果性质 | **诊断结果仅供缺素参考，不提供具体化肥浓度与用量**；精准施肥请咨询农技专家 |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.| 🧑⚖️ 结果性质 | 当显示历史诊断报告清单的时候，从接口返回 json 数据中提取字段 作为超链接地址，且自动转化为如下 Markdown |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.# result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.base-url-open-h5: "http://192.168.1.234:4100"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim smyx-sunjinhui: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- URL to a private-network address≈ +1 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.