Skill Trust Decision

smyx-chinese-herbal-ingredient-trend-analysis

Name: smyx-chinese-herbal-ingredient-trend-analysis Trust Review Report
Item: smyx-chinese-herbal-ingredient-trend-analysis
Rating: 80
Author: ClawSafe

该技能为合法的中药材叶片图像分析工具，代码结构清晰，外部通信仅限于官方API服务，自动身份管理是合理的功能设计，无恶意行为发现。

Install decision first Source: ClawHub Scanned: Aug 23, 2026

Files 30

Artifacts 12

Violations 0

Findings 3

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

环境变量读取 +5

读取OPENCLAW_SENDER_OPEN_ID等上游身份变量，符合文档声明的'系统自动处理身份'

本地SQLite存储用户凭证 +5

UserDao存储token/open_token用于API认证，凭证保留本地不上传外部

自动创建默认用户 +5

OpenIdUtil生成User_*用户并存储本地，属于合理的身份初始化设计

外部API数据传输 +5

上传图像/视频到lifeemergence.com，有文档声明'历史报告和上传数据发送到后端服务'

Most important evidence

Low Supply Chain

依赖包无版本锁定风险

requirements.txt使用精确版本号(pydash==8.0.6, SQLAlchemy==2.0.46)，但smyx_analysis依赖yaml==6.0.3未使用标准包名(PyYAML)

skills/smyx_analysis/requirements.txt:3

建议统一使用PyYAML==6.0.3，避免包名歧义

Low Sensitive Access

环境变量读取

config.py读取OPENCLAW_SENDER_OPEN_ID等上游身份变量，用于身份初始化，属于合理的系统集成行为

skills/smyx_common/scripts/config.py:141

已声明为'系统内部自动处理'，无需额外披露

Info Doc Mismatch

文档与实现基本一致

SKILL.md声明的功能(图像分析、历史报告查询、云端API调用)与代码实现相符，无发现文档欺骗行为

SKILL.md:1

无需处理

Declared capability vs actual capability

Filesystem Pass

Declared READ

→

Inferred READ

smyx_analysis.py:67-76 读取用户上传的图像/视频文件

Network Pass

Declared WRITE

→

Inferred WRITE

util.py:RequestUtil.http_request 向外部API发送请求

Environment Pass

Declared NONE

→

Inferred READ

config.py:141-146 读取OPENCLAW_SENDER_*环境变量

Database Pass

Declared NONE

→

Inferred WRITE

dao.py:UserDao 本地SQLite存储用户凭证，但用于API认证而非外泄

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:40

Medium External URL

https://clawhub.ai/user/18072937735

skill-card.md:9

Medium External URL

https://clawhub.ai/18072937735/skills/smyx-chinese-herbal-ingredient-trend-analysis

skill-card.md:43

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
pydash	`8.0.6`	pip	No	精确版本锁定
SQLAlchemy	`2.0.46`	pip	No	精确版本锁定
PyYAML	`6.0.3`	pip	No	精确版本锁定(但包名为yaml)
requests	`>=2.28.0`	pip	No	smyx_analysis依赖最低版本限制

File composition

30 files · 2681 lines

Python 18 files · 2363 linesMarkdown 4 files · 283 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 3

skills/smyx_common/scripts/config.py Python · 399 lines

环境变量读取

SKILL.md Markdown · 180 lines

文档与实现基本一致 · https://lifeemergence.com/sample.html

skill-card.md Markdown · 64 lines

https://clawhub.ai/user/18072937735 · https://clawhub.ai/18072937735/skills/smyx-chinese-herbal-ingredient-trend-analysis

Other files · util.py · dao.py · skill.py · smyx_analysis.py · smyx_chinese_herbal_ingredient_trend_analysis.py · api_service.py +3

30 files · 109.8 KB · 2681 lines

Python 18f · 2363LMarkdown 4f · 283LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 630 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 66 B

│ ├─ 🐍 config.py Python 24L · 699 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 588 B

│ └─ 🐍 smyx_chinese_herbal_ingredient_trend_analysis.py Python 102L · 3.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 180L · 12.3 KB

└─ 📝 skill-card.md Markdown 64L · 2.7 KB

Security positives

代码结构清晰，模块化设计合理(smyx_analysis + smyx_common分离)

无base64编码、eval执行、远程脚本下载等恶意代码特征

无敏感路径访问(~/.ssh, ~/.aws, .env等)

无C2通信、数据外泄、凭证收割行为

API通信使用HTTPS加密

本地数据库存储凭证用于认证而非外泄

自动身份管理有完整文档说明

依赖包版本锁定，降低供应链风险