Skill Trust Decision

smyx-driver-flushing-sweat-detection-analysis

Name: smyx-driver-flushing-sweat-detection-analysis Trust Review Report
Item: smyx-driver-flushing-sweat-detection-analysis
Rating: 75
Author: ClawSafe

合法驾驶员健康监测技能，存在调试日志泄露和凭证持久化存储风险，但无恶意行为证据

Install decision first Source: ClawHub Scanned: 29 days ago

Files 30

Artifacts 12

Violations 1

Findings 5

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

调试模式HTTP日志泄露 +10

is_debug()为True时打印完整请求详情，可能暴露凭证

SQLite持久化凭证存储 +8

token/open_token存储在本地数据库smyx-common-claw.db

静默用户注册机制 +5

自动通过phoneLogin注册默认用户，未显式用户授权

无版本锁定依赖 +2

requests>=2.28.0无上限，可能引入漏洞版本

Most important evidence

Medium Sensitive Access

调试模式HTTP请求日志泄露敏感数据

当is_debug()返回True时，http.client.debuglevel启用并打印完整请求详情，包括headers中的X-Access-Token、X-Api-Key等敏感凭证

skills/smyx_common/scripts/util.py:37

生产环境设置IS_DEBUG=false，或过滤日志中的敏感header

Medium Credential Theft

凭证持久化存储于本地SQLite数据库

User模型包含token和open_token字段，存储在data/smyx-common-claw.db中，存在凭证泄露风险

skills/smyx_common/scripts/dao.py:182

使用系统密钥链或加密存储，避免明文数据库存储凭证

Medium Doc Mismatch

静默用户注册与登录未在文档声明

OpenIdUtil.resolve_current_open_id自动创建默认用户(User_xxxxxx格式)并通过/sys/phoneLogin接口注册，SKILL.md未声明此行为

skills/smyx_common/scripts/util.py:252

在文档中明确说明用户身份自动初始化机制

Low Supply Chain

依赖包无版本上限锁定

requirements.txt中requests>=2.28.0无上限，可能拉取存在漏洞的更新版本

skills/smyx_analysis/requirements.txt:1

锁定具体版本如requests==2.31.0

Low Sensitive Access

明文HTTP开发环境配置

config-dev.yaml中使用192.168.1.234等内网明文HTTP地址，存在中间人攻击风险

skills/smyx_common/scripts/config-dev.yaml:2

生产部署使用config.yaml中的HTTPS配置

Declared capability vs actual capability

Filesystem Pass

Declared READ

→

Inferred READ

skills/smyx_analysis/scripts/skill.py:80 file read

Network Pass

Declared READ

→

Inferred WRITE

skills/smyx_common/scripts/util.py:295 POST requests to cloud API

Database Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:88 SQLite create_engine

Shell Pass

Declared NONE

→

Inferred READ

SKILL.md:93 python -m scripts调用

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:34

Medium External URL

https://clawhub.ai/user/smyx-sunjinhui

skill-card.md:9

Medium External URL

https://clawhub.ai/smyx-sunjinhui/skills/smyx-driver-flushing-sweat-detection-analysis

skill-card.md:39

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	无版本上限锁定
pydash	`==8.0.6`	pip	No	版本已锁定
SQLAlchemy	`==2.0.46`	pip	No	版本已锁定
PyYAML	`==6.0.3`	pip	No	版本已锁定

File composition

30 files · 2715 lines

Python 18 files · 2363 linesMarkdown 4 files · 317 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 4

skills/smyx_common/scripts/util.py Python · 718 lines

调试模式HTTP请求日志泄露敏感数据 · 静默用户注册与登录未在文档声明

skills/smyx_common/scripts/dao.py Python · 499 lines

凭证持久化存储于本地SQLite数据库

SKILL.md Markdown · 178 lines

https://lifeemergence.com/sample.html

skill-card.md Markdown · 59 lines

https://clawhub.ai/user/smyx-sunjinhui · https://clawhub.ai/smyx-sunjinhui/skills/smyx-driver-flushing-sweat-detection-analysis

Other files · config.py · skill.py · smyx_analysis.py · smyx_driver_flushing_sweat_detection_analysis.py · api_doc.md · api_service.py +2

30 files · 112.7 KB · 2715 lines

Python 18f · 2363LMarkdown 4f · 317LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 61L · 3.0 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 61 B

│ ├─ 🐍 config.py Python 24L · 700 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 589 B

│ └─ 🐍 smyx_driver_flushing_sweat_detection_analysis.py Python 102L · 3.6 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 178L · 13.0 KB

└─ 📝 skill-card.md Markdown 59L · 2.5 KB

Security positives

功能代码清晰，无混淆或恶意编码模式

未发现subprocess/shell注入漏洞

未发现凭证收割或数据外泄行为

API调用目标为正规企业域名(lifeemergence.com)

依赖包来源可信(PyPI官方)

数据库路径强制重定向到工作区data目录，防止污染