Skill Trust Decision

smyx-adaptive-pet-drying-temperature-analysis

Name: smyx-adaptive-pet-drying-temperature-analysis Trust Review Report
Item: smyx-adaptive-pet-drying-temperature-analysis
Rating: 75
Author: ClawSafe

宠物烘干温度推荐技能，代码实现与声称功能基本一致，存在轻微文档-行为差异（数据库操作、身份管理未声明），但属于框架正常需求，无恶意行为发现。

Install decision first Source: ClawHub Scanned: Aug 27, 2026

Files 31

Artifacts 12

Violations 1

Findings 5

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

影子功能-数据库操作 +10

创建SQLite数据库存储用户信息，SKILL.md未声明

影子功能-身份管理 +8

OpenIdUtil自动生成/复用User_*身份，文档未提及

敏感凭证存储 +5

数据库存储token/open_token等敏感信息，但有合理业务用途

Agent工作区感知 +2

AgentContextUtil检测Agent工作区，框架正常功能

Most important evidence

Low Doc Mismatch

数据库操作未声明

代码创建SQLite数据库(smyx-common-claw.db)存储用户凭证和token信息，SKILL.md完全未提及数据库相关操作

skills/smyx_common/scripts/dao.py:47

在SKILL.md中补充数据库存储说明，明确数据用途和保留策略

Low Doc Mismatch

自动身份管理未声明

OpenIdUtil类实现自动身份生成(User_XXXXXX格式)、存储和复用逻辑，用户无法感知或控制

skills/smyx_common/scripts/util.py:180

在SKILL.md中明确说明内部身份机制，确保用户知情同意

Low Sensitive Access

环境变量读取

从环境变量读取OPENCLAW_SENDER_OPEN_ID、OPENCLAW_SENDER_USERNAME、FEISHU_OPEN_ID等身份信息

skills/smyx_common/scripts/config.py:85

确认环境变量来源可信，限制读取范围

Info Supply Chain

依赖版本锁定良好

所有依赖包均指定了精确版本(pydash==8.0.6, SQLAlchemy==2.0.46, PyYAML==6.0.3)，无版本锁定风险

skills/smyx_common/requirements.txt:1

当前依赖管理规范良好，保持此做法

Info Doc Mismatch

注释代码暗示潜在RCE风险

skills/smyx_common/scripts/skill.py中包含subprocess调用openclaw agent的注释代码(已注释)，虽无实际执行但暗示潜在远程命令执行能力

skills/smyx_common/scripts/skill.py:40

删除注释代码或明确说明为何保留

Declared capability vs actual capability

Filesystem Pass

Declared NONE

→

Inferred WRITE

scripts/smyx_adaptive_pet_drying_temperature_analysis.py:52-56 写入分析结果

Network Pass

Declared READ

→

Inferred READ

调用服务端API处理图像，行为一致

Database Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:47 创建smyx-common-claw.db

Environment Pass

Declared NONE

→

Inferred READ

skills/smyx_common/scripts/config.py:85-88 读取OPENCLAW/FEISHU环境变量

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:39

Medium External URL

https://clawhub.ai/user/18072937735

skill-card.md:9

Medium External URL

https://clawhub.ai/18072937735/skills/smyx-adaptive-pet-drying-temperature-analysis

skill-card.md:39

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
pydash	`8.0.6`	pip	No	版本锁定
SQLAlchemy	`2.0.46`	pip	No	版本锁定
PyYAML	`6.0.3`	pip	No	版本锁定

File composition

31 files · 2702 lines

Python 18 files · 2363 linesMarkdown 4 files · 294 linesYAML 6 files · 29 linesJSON 1 files · 10 linesText 2 files · 6 lines

Files of concern · 6

skills/smyx_common/scripts/util.py Python · 718 lines

自动身份管理未声明

skills/smyx_common/scripts/config.py Python · 399 lines

环境变量读取

skills/smyx_common/scripts/dao.py Python · 499 lines

数据库操作未声明

SKILL.md Markdown · 190 lines

https://lifeemergence.com/sample.html

skill-card.md Markdown · 60 lines

https://clawhub.ai/user/18072937735 · https://clawhub.ai/18072937735/skills/smyx-adaptive-pet-drying-temperature-analysis

skills/smyx_common/scripts/skill.py Python · 85 lines

注释代码暗示潜在RCE风险

Other files · skill.py · smyx_analysis.py · smyx_adaptive_pet_drying_temperature_analysis.py · api_service.py · api_service.py · config.py

31 files · 109.5 KB · 2702 lines

Python 18f · 2363LMarkdown 4f · 294LYAML 6f · 29LJSON 1f · 10LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 25L · 894 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 65 B

│ ├─ 🐍 config.py Python 24L · 685 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 582 B

│ └─ 🐍 smyx_adaptive_pet_drying_temperature_analysis.py Python 102L · 3.6 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 190L · 11.8 KB

├─ 📋 _meta.json JSON 10L · 174 B

└─ 📝 skill-card.md Markdown 60L · 2.4 KB

Security positives

依赖版本精确锁定(pydash==8.0.6, SQLAlchemy==2.0.46, PyYAML==6.0.3)，无供应链风险

API端点使用HTTPS加密传输(lifeemergence.com)

数据库隔离在工作区共享目录，避免污染系统路径

Agent工作区感知机制防止跨Agent数据污染

敏感token不在输出中暴露(日志中截断显示)

功能实现逻辑清晰，无明显混淆或恶意编码模式