Skill Trust Decision

smyx-separation-anxiety-relief-analysis

Name: smyx-separation-anxiety-relief-analysis Trust Review Report
Item: smyx-separation-anxiety-relief-analysis
Rating: 80
Author: ClawSafe

合法的宠物分离焦虑检测技能，代码行为与文档声明基本一致，存在少量设计瑕疵但不构成实质威胁。

Install decision first Source: ClawHub Scanned: Aug 23, 2026

Files 29

Artifacts 10

Violations 0

Findings 4

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

subprocess 被注释但存在痕迹 +8

skill.py 保留了 ai_chat() 方法的 subprocess 调用注释，虽未激活但存在设计瑕疵

凭证明文存储 +6

用户凭证（token、open_token）明文存储在 SQLite 数据库和文本文件中

依赖无版本锁定 +4

requests>=2.28.0 无上限版本锁定，存在供应链风险

环境变量读取 +2

读取 OPENCLAW_SENDER_OPEN_ID 等环境变量，符合业务需求但值得注意

Most important evidence

Low Supply Chain

依赖包无版本上限锁定

SKILL.md 声明 requests>=2.28.0 但无上限版本，可能引入恶意更新

SKILL.md:146

锁定具体版本，如 requests==2.31.0

Low Obfuscation

subprocess 调用代码被注释但未删除

skills/smyx_common/scripts/skill.py 保留了 ai_chat() 方法和 subprocess 相关注释代码，虽未执行但增加分析难度

skills/smyx_common/scripts/skill.py:15

完全删除不再使用的 subprocess 相关代码

Low Sensitive Access

用户凭证明文存储

用户 token、open_token 明文存储在 SQLite 数据库和 data/smyx-api-key.txt 中，LocalSystem 权限下可被读取

skills/smyx_common/scripts/dao.py:65

考虑加密存储或使用系统密钥管理服务

Info Doc Mismatch

SKILL.md 未声明数据库和文件写入能力

文档声明 filesystem:READ 和 network:READ，但代码实际使用 SQLite 数据库和写入日志文件

SKILL.md:1

补充声明 database 资源使用

Declared capability vs actual capability

Filesystem Pass

Declared READ

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:91 创建 SQLite 数据库文件

Network Pass

Declared READ

→

Inferred READ

skills/smyx_common/scripts/util.py:340 仅向 lifeemergence.com 域名发起 HTTP 请求

Shell Pass

Declared NONE

→

Inferred NONE

skills/smyx_common/scripts/skill.py:18 subprocess 调用已被注释

Database Pass

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:91 创建 SQLite 数据库 smyx-common-claw.db

Environment Pass

Declared NONE

→

Inferred READ

skills/smyx_common/scripts/config.py:98 读取 OPENCLAW_SENDER_OPEN_ID 等环境变量

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:34

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	无版本上限锁定
pydash	`8.0.6`	pip	No	精确版本
SQLAlchemy	`2.0.46`	pip	No	精确版本
PyYAML	`6.0.3`	pip	No	精确版本

File composition

29 files · 2654 lines

Python 18 files · 2360 linesMarkdown 3 files · 259 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 3

skills/smyx_common/scripts/dao.py Python · 499 lines

用户凭证明文存储

SKILL.md Markdown · 220 lines

依赖包无版本上限锁定 · SKILL.md 未声明数据库和文件写入能力 · https://lifeemergence.com/sample.html

skills/smyx_common/scripts/skill.py Python · 85 lines

subprocess 调用代码被注释但未删除

Other files · util.py · config.py · skill.py · smyx_analysis.py · smyx_separation_anxiety_relief_analysis.py · api_service.py +3

29 files · 109.1 KB · 2654 lines

Python 18f · 2360LMarkdown 3f · 259LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 688 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 57 B

│ ├─ 🐍 config.py Python 24L · 697 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 594 B

│ └─ 🐍 smyx_separation_anxiety_relief_analysis.py Python 99L · 3.4 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

└─ 📝 SKILL.md Markdown 220L · 14.3 KB

Security positives

所有网络请求都发往声明的外部域名（lifeemergence.com 系列），无可疑外部通信

代码逻辑清晰，API 服务封装规范，无隐蔽的数据外泄行为

数据库使用工作区隔离机制，不同 Agent 使用独立数据目录

用户身份（open_id）自动生成，不依赖用户输入，保护隐私

subprocess 调用已被注释，不会在当前版本执行

依赖包均为知名开源库（requests、SQLAlchemy、PyYAML、pydash）