Skill Trust Decision

smyx-eye-anomaly-detection-analysis

Name: smyx-eye-anomaly-detection-analysis Trust Review Report
Item: smyx-eye-anomaly-detection-analysis
Rating: 60
Author: ClawSafe

技能核心功能为宠物眼部图像/视频AI分析，行为与声明基本一致，但存在未充分披露的影子身份管理系统和本地凭证存储行为，构成中等风险。

Install decision first Source: ClawHub Scanned: 20 days ago

Files 31

Artifacts 12

Violations 3

Findings 4

Most direct threat evidence

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

3 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

影子身份管理系统 +15

OpenIdUtil自动创建/复用User_开头的本地身份，未在SKILL.md中披露

本地SQLite凭证存储 +12

UserDao在data/目录存储token/open_token等敏感凭证

媒体数据外传 +8

用户图像/视频上传至lifeemergence.com API，但已在skill-card.md已知风险中披露

硬编码API密钥 +5

config.yaml包含app-id、feishu-app-id等配置

Most important evidence

Medium Sensitive Access

未披露的影子身份管理系统

OpenIdUtil类在util.py中实现了自动身份解析和创建逻辑，会在data/目录生成smyx-api-key.txt文件，并创建User_开头的本地SQLite记录，用于关联用户身份和API令牌。该行为未在SKILL.md中披露。

skills/smyx_common/scripts/util.py:207

在SKILL.md中明确披露本地身份管理系统的工作原理、数据存储位置和用途

Medium Credential Theft

本地SQLite数据库存储认证凭证

UserDao将token和open_token存储在data/smyx-common-claw.db中，包含用户身份标识和API访问令牌。虽然这些凭证用于访问同一平台服务，但本地明文存储存在泄露风险。

skills/smyx_common/scripts/dao.py:48

评估凭证存储必要性，考虑使用系统密钥链或加密存储

Low Doc Mismatch

配置文件包含硬编码凭证

config.yaml包含app-id、feishu-app-id等应用标识符，虽非用户级密钥，但仍属于敏感配置信息。

skills/smyx_common/scripts/config.yaml:1

使用环境变量替代硬编码配置值

Low Supply Chain

依赖包无版本锁定

skills/smyx_analysis/requirements.txt中pydash==8.0.6、SQLAlchemy==2.0.46、PyYAML==6.0.3均为精确版本锁定，符合安全实践。但顶层scripts目录无requirements.txt。

skills/smyx_analysis/requirements.txt:1

已符合版本锁定要求，保持现状

Declared capability vs actual capability

Filesystem Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:161 - 创建SQLite数据库文件

Network Pass

Declared READ

→

Inferred READ

skills/smyx_common/scripts/util.py:270 - 调用外部API进行图像分析

Environment Block

Declared NONE

→

Inferred READ

skills/smyx_common/scripts/config.py:82 - 读取OPENCLAW_SENDER_OPEN_ID等环境变量

Database Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:170 - 创建并写入smyx-common-claw.db

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:34

Medium External URL

https://clawhub.ai/user/smyx-sunjinhui

skill-card.md:9

Medium External URL

https://clawhub.ai/smyx-sunjinhui/skills/smyx-eye-anomaly-detection-analysis

skill-card.md:43

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
pydash	`8.0.6`	pip	No	精确版本锁定
SQLAlchemy	`2.0.46`	pip	No	精确版本锁定
PyYAML	`6.0.3`	pip	No	精确版本锁定
requests	`>=2.28.0`	pip	No	SKILL.md声明但未锁定上限版本

File composition

31 files · 2706 lines

Python 18 files · 2360 linesMarkdown 4 files · 306 linesYAML 6 files · 29 linesText 2 files · 6 linesJSON 1 files · 5 lines

Files of concern · 4

skills/smyx_common/scripts/util.py Python · 718 lines

未披露的影子身份管理系统

skills/smyx_common/scripts/dao.py Python · 499 lines

本地SQLite数据库存储认证凭证

SKILL.md Markdown · 204 lines

https://lifeemergence.com/sample.html

skill-card.md Markdown · 63 lines

https://clawhub.ai/user/smyx-sunjinhui · https://clawhub.ai/smyx-sunjinhui/skills/smyx-eye-anomaly-detection-analysis

Other files · config.py · skill.py · smyx_analysis.py · smyx_eye_anomaly_detection_analysis.py · api_service.py · skill.py +2

31 files · 109.6 KB · 2706 lines

Python 18f · 2360LMarkdown 4f · 306LYAML 6f · 29LText 2f · 6LJSON 1f · 5L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 692 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 80 B

│ ├─ 🐍 config.py Python 24L · 701 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 602 B

│ └─ 🐍 smyx_eye_anomaly_detection_analysis.py Python 99L · 3.4 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 473 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 204L · 12.3 KB

├─ 📋 _meta.json JSON 5L · 154 B

└─ 📝 skill-card.md Markdown 63L · 2.3 KB

Security positives

核心图像分析功能声明清晰，与实际行为一致

依赖包使用精确版本锁定(==)，符合供应链安全最佳实践

skill-card.md已知风险章节披露了外部API调用和数据外传风险

代码结构清晰，使用标准库和成熟框架(SQLAlchemy)

支持调试模式，可追踪请求行为

无恶意代码特征：无base64编码执行、无远程shell、无凭证收割模式