Skill Trust Decision

staff-absence-detection-analysis

Name: staff-absence-detection-analysis Trust Review Report
Item: staff-absence-detection-analysis
Rating: 78
Author: ClawSafe

合法的人员离岗监测技能，使用云端API进行计算机视觉分析，存在轻微文档-行为差异但不影响安全

Install decision first Source: ClawHub Scanned: Aug 23, 2026

Files 28

Artifacts 10

Violations 0

Findings 4

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

文档未声明database权限 +8

代码创建SQLite数据库存储用户凭证，SKILL.md未提及

文档未声明filesystem权限 +5

代码读取本地文件写入输出文件，SKILL.md未提及

未使用的ai_chat代码 +5

AgentSkill.ai_chat存在subprocess调用但被注释，仅占位代码

配置包含敏感信息 +4

config.yaml包含App-ID和租户代码，属于系统配置非凭证

Most important evidence

Low Doc Mismatch

文档未声明database权限

代码在data目录创建SQLite数据库(smyx-common-claw.db)存储用户凭证和token，但SKILL.md资源索引未声明database权限

skills/smyx_common/scripts/dao.py:50

在SKILL.md资源索引中补充database:WRITE声明，说明用于本地凭证缓存

Low Doc Mismatch

文档未声明filesystem权限

代码读取本地视频/图片文件并可写入结果文件，但SKILL.md未声明filesystem权限

skills/smyx_analysis/scripts/skill.py:98

在SKILL.md中声明filesystem:READ用于输入文件，filesystem:WRITE用于输出文件

Low Supply Chain

依赖版本已锁定

requirements.txt中依赖版本已明确锁定(pydash==8.0.6, SQLAlchemy==2.0.46)，无供应链风险

skills/smyx_analysis/requirements.txt:1

无需操作，当前依赖管理规范

Info Obfuscation

未使用的ai_chat占位代码

smyx_common/scripts/skill.py中AgentSkill.ai_chat方法包含subprocess.run调用代码，但被注释。cmd列表为空，无实际执行风险

skills/smyx_common/scripts/skill.py:48

删除未使用的代码或明确标注为预留功能

Declared capability vs actual capability

Filesystem Pass

Declared NONE

→

Inferred READ

skills/smyx_analysis/scripts/skill.py:98-100 读取本地视频文件

Filesystem Pass

Declared NONE

→

Inferred WRITE

skills/smyx_analysis/scripts/smyx_analysis.py:67-68 写入结果文件

Network Pass

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/util.py:200-210 发起HTTP请求到外部API

Database Pass

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:50-51 创建SQLite数据库

Shell Pass

Declared NONE

→

Inferred NONE

skills/smyx_common/scripts/skill.py:48-49 subprocess调用被注释，无实际执行

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:41

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
pydash	`8.0.6`	pip	No	版本已锁定
SQLAlchemy	`2.0.46`	pip	No	版本已锁定
PyYAML	`6.0.3`	pip	No	版本已锁定
requests	`>=2.28.0`	pip	No	最低版本锁定

File composition

28 files · 2826 lines

Python 17 files · 2493 linesMarkdown 3 files · 298 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 4

skills/smyx_common/scripts/dao.py Python · 499 lines

文档未声明database权限

SKILL.md Markdown · 178 lines

https://lifeemergence.com/sample.html

skills/smyx_analysis/scripts/skill.py Python · 175 lines

文档未声明filesystem权限

skills/smyx_common/scripts/skill.py Python · 85 lines

未使用的ai_chat占位代码

Other files · util.py · config.py · staff_absence_detection_analysis.py · smyx_analysis.py · api_service.py · api_doc.md +2

28 files · 112.4 KB · 2826 lines

Python 17f · 2493LMarkdown 3f · 298LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 101L · 2.2 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 config.py Python 26L · 779 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 579 B

│ └─ 🐍 staff_absence_detection_analysis.py Python 231L · 8.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

└─ 📝 SKILL.md Markdown 178L · 11.0 KB

Security positives

代码结构清晰，模块化设计合理

依赖版本已锁定，无版本浮动风险

敏感配置从config.yaml加载，非硬编码

API调用使用HTTPS加密传输

数据库存储在workspace data目录，权限隔离正确

subprocess调用代码被注释，无RCE风险

无base64编码、eval动态执行等可疑行为

无环境变量敏感关键字遍历行为