Skill Trust Decision

smyx-pet-litter-box-waste-analysis

Name: smyx-pet-litter-box-waste-analysis Trust Review Report
Item: smyx-pet-litter-box-waste-analysis
Rating: 80
Author: ClawSafe

宠物猫砂盆排泄物性状识别技能，代码结构清晰，核心功能为视频分析+API调用，无恶意行为，仅存在文档声明不完整的中等风险。

Install decision first Source: ClawHub Scanned: Aug 26, 2026

Files 30

Artifacts 12

Violations 3

Findings 4

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

3 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

文档声明不完整 +10

SKILL.md未声明网络请求和本地文件读取能力，但代码确实执行了这些操作

注释代码残留 +5

smyx_common/scripts/skill.py:26-35 存在注释掉的 subprocess.run 代码，存在未来激活的风险

凭证明文配置 +5

config.yaml 中硬编码 app-id 等凭证，虽为服务所需但建议使用环境变量

Most important evidence

Medium Doc Mismatch

文档声明与实际能力不一致

SKILL.md 未声明网络请求和本地文件读取能力。技能通过 requests 库调用远程 API (lifeemergence.com)，并读取本地视频文件进行上传分析。

skills/smyx_analysis/scripts/skill.py:86

在 SKILL.md 能力范围中补充声明：文件读取 (本地视频)、网络请求 (调用服务端API)

Low RCE

注释代码残留潜在风险

smyx_common/scripts/skill.py 中存在注释掉的 subprocess.run 代码，该代码原本用于调用 openclaw agent 命令。虽然当前不会执行，但代码框架存在未来被激活的风险。

skills/smyx_common/scripts/skill.py:26

如果该功能不需要，建议彻底删除此段代码，而非注释保留

Low Sensitive Access

环境变量读取敏感信息

代码读取 OPENCLAW_SENDER_OPEN_ID、OPENCLAW_SENDER_USERNAME、FEISHU_OPEN_ID 等环境变量作为身份标识。

skills/smyx_common/scripts/config.py:65

这是正常的身份传递机制，建议在文档中说明身份参数由系统自动处理

Info Supply Chain

依赖版本锁定

requirements.txt 中 requests>=2.28.0 使用了版本下限约束，无已知漏洞。

skills/smyx_analysis/requirements.txt:1

可考虑锁定精确版本以提高可重复性

Declared capability vs actual capability

Filesystem Block

Declared NONE

→

Inferred READ

smyx_analysis/scripts/skill.py:86 open()

Network Block

Declared NONE

→

Inferred READ

smyx_common/scripts/util.py:280 requests.request()

Database Block

Declared NONE

→

Inferred WRITE

smyx_common/scripts/dao.py:88 session.add()

Shell Pass

Declared NONE

→

Inferred NONE

smyx_common/scripts/skill.py:33 subprocess.run (注释状态，无风险)

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:30

Medium External URL

https://clawhub.ai/user/smyx-sunjinhui

skill-card.md:9

Medium External URL

https://clawhub.ai/smyx-sunjinhui/skills/smyx-pet-litter-box-waste-analysis

skill-card.md:39

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	无已知漏洞
pydash	`*`	pip	No	可选依赖，有 fallback

File composition

30 files · 2667 lines

Python 18 files · 2363 linesMarkdown 4 files · 269 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 5

skills/smyx_common/scripts/config.py Python · 399 lines

环境变量读取敏感信息

SKILL.md Markdown · 170 lines

https://lifeemergence.com/sample.html

skills/smyx_analysis/scripts/skill.py Python · 175 lines

文档声明与实际能力不一致

skill-card.md Markdown · 60 lines

https://clawhub.ai/user/smyx-sunjinhui · https://clawhub.ai/smyx-sunjinhui/skills/smyx-pet-litter-box-waste-analysis

skills/smyx_common/scripts/skill.py Python · 85 lines

注释代码残留潜在风险

Other files · util.py · dao.py · smyx_analysis.py · smyx_pet_litter_box_waste_analysis.py · api_service.py · api_service.py +1

30 files · 106.7 KB · 2667 lines

Python 18f · 2363LMarkdown 4f · 269LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 630 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 64 B

│ ├─ 🐍 config.py Python 24L · 671 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 579 B

│ └─ 🐍 smyx_pet_litter_box_waste_analysis.py Python 102L · 3.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 170L · 9.6 KB

└─ 📝 skill-card.md Markdown 60L · 2.4 KB

Security positives

技能功能明确，代码结构清晰，逻辑简单

无 base64 编码、eval()、裸 IP 网络请求等高危模式

无敏感路径遍历（如 ~/.ssh、~/.aws）

API 凭证仅用于连接指定服务端，不会外传

subprocess.run 代码已被注释，不会执行

使用 SQLite 本地存储用户数据，不涉及凭证外泄