Skill Trust Decision

smyx-elderly-night-bed-exit-wandering-analysis

Name: smyx-elderly-night-bed-exit-wandering-analysis Trust Review Report
Item: smyx-elderly-night-bed-exit-wandering-analysis
Rating: 78
Author: ClawSafe

合法的养老院夜间离床监测技能，调用远程API分析视频，无恶意行为。subprocess代码被注释但仍存风险隐患，依赖无版本锁定存在供应链风险。

Install decision first Source: ClawHub Scanned: 24 days ago

Files 30

Artifacts 12

Violations 0

Findings 3

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

subprocess 存在注释代码 +10

AgentSkill.ai_chat 中存在被注释的 subprocess 调用代码，存在潜在执行能力但未激活

依赖无版本锁定 +10

requirements.txt 使用 requests>=2.28.0 通配版本，存在供应链风险

本地存储敏感凭证 +2

SQLite 数据库存储 token/open_token，但属于 API 调用必要凭证，非窃取行为

Most important evidence

Medium Supply Chain

依赖包无版本锁定

requirements.txt 中 requests>=2.28.0 使用通配版本，未锁定具体版本号，可能引入恶意版本

skills/smyx_analysis/requirements.txt:1

建议锁定具体版本：requests==2.31.0

Low RCE

subprocess代码存在但被注释

AgentSkill.ai_chat 方法包含完整的subprocess调用代码（已注释），虽然未执行但表明技能具备远程命令执行能力

skills/smyx_common/scripts/skill.py:61

确认 AgentSkill 类是否必需，如不使用建议删除注释代码

Low Sensitive Access

读取环境变量用于用户身份识别

代码读取 OPENCLAW_SENDER_OPEN_ID、OPENCLAW_SENDER_USERNAME、FEISHU_OPEN_ID 等环境变量用于内部用户身份管理

skills/smyx_common/scripts/config.py:155

确认环境变量来源，确保不被恶意注入

Declared capability vs actual capability

Network Pass

Declared READ

→

Inferred READ

SKILL.md:声明调用远程API，代码仅使用 requests 发送HTTP请求

Filesystem Pass

Declared WRITE

→

Inferred WRITE

SKILL.md:声明保存附件/输出结果，代码写本地文件

Database Pass

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:49 创建SQLite数据库存储用户信息

Shell Pass

Declared NONE

→

Inferred NONE

skills/smyx_common/scripts/skill.py:26 注释的subprocess调用

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:34

Medium External URL

https://clawhub.ai/user/18072937735

skill-card.md:9

Medium External URL

https://clawhub.ai/18072937735/skills/smyx-elderly-night-bed-exit-wandering-analysis

skill-card.md:39

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	无版本锁定
pydash	`8.0.6`	pip	No	已锁定版本
SQLAlchemy	`2.0.46`	pip	No	已锁定版本
PyYAML	`6.0.3`	pip	No	已锁定版本

File composition

30 files · 2704 lines

Python 18 files · 2363 linesMarkdown 4 files · 306 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 4

skills/smyx_common/scripts/config.py Python · 399 lines

读取环境变量用于用户身份识别

SKILL.md Markdown · 178 lines

https://lifeemergence.com/sample.html

skills/smyx_common/scripts/skill.py Python · 85 lines

subprocess代码存在但被注释

skill-card.md Markdown · 58 lines

https://clawhub.ai/user/18072937735 · https://clawhub.ai/18072937735/skills/smyx-elderly-night-bed-exit-wandering-analysis

Other files · util.py · dao.py · skill.py · smyx_analysis.py · smyx_elderly_night_bed_exit_wandering_analysis.py · api_service.py +2

30 files · 110.3 KB · 2704 lines

Python 18f · 2363LMarkdown 4f · 306LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 51L · 2.0 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 60 B

│ ├─ 🐍 config.py Python 24L · 703 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 591 B

│ └─ 🐍 smyx_elderly_night_bed_exit_wandering_analysis.py Python 102L · 3.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 473 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 178L · 11.8 KB

└─ 📝 skill-card.md Markdown 58L · 2.3 KB

Security positives

无恶意代码：无反向shell、C2通信、数据窃取等恶意行为

功能合法：视频分析API集成，用途明确（老年人夜间监测）

声明-行为一致：SKILL.md描述的功能与实际代码实现相符

敏感信息本地存储：token存储在SQLite用于API调用，非外泄凭证

无隐藏功能：代码未发现文档未声明的敏感操作