Skill Trust Decision

smyx-respiratory-rate-abnormal-detect-analysis

Name: smyx-respiratory-rate-abnormal-detect-analysis Trust Review Report
Item: smyx-respiratory-rate-abnormal-detect-analysis
Rating: 55
Author: ClawSafe

The skill performs legitimate pet respiratory monitoring via video analysis but has multiple undisclosed behaviors: silent user identity creation/stored in local SQLite, auto-resolution of identity from environment variables, and local database writes not declared in SKILL.md. Additionally, development plaintext HTTP endpoints are present, and dependency pinning is absent.

Install decision first Source: ClawHub Scanned: 27 days ago

Files 31

Artifacts 12

Violations 4

Findings 8

Most direct threat evidence

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

4 dependency or supply-chain issues need attention.

What drove the risk score up

Undisclosed local SQLite token storage +15

SKILL.md nowhere mentions that user tokens, open_tokens, and user records are stored in a local SQLite database (smyx-common-claw.db). This is a hidden persistent state mechanism.

Silent user identity creation and auto-resolution +10

OpenIdUtil auto-generates User_xxxxxx identities, reads smyx-api-key.txt, and queries/modifies local DB — none of which are declared in SKILL.md user identity handling section.

Undeclared environment variable access +5

ConstantEnum.init() reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHu_OPEN_ID from os.environ — not declared in SKILL.md.

Plaintext HTTP development endpoints +5

config-dev.yaml contains HTTP plaintext endpoints (192.168.1.234) — skill-card.md acknowledges this as a known risk but SKILL.md does not.

Unpinned requests dependency +5

requirements.txt specifies requests>=2.28.0 without upper bound; older versions have known vulnerabilities.

Silent file write to user-specified path +5

The --output flag writes arbitrary content to user-specified filesystem paths without declared scope limits.

Most important evidence

Medium Doc Mismatch

Undisclosed local SQLite token storage

SKILL.md describes 'automatic internal identity handling' but never mentions that tokens, open_tokens, and user records are persisted to a local SQLite database (smyx-common-claw.db) in the agent's data directory. This is hidden persistent state.

skills/smyx_common/scripts/dao.py:61

Declare local token persistence in SKILL.md. Users should know that credentials are cached locally.

Medium Doc Mismatch

Silent user identity auto-creation not declared

OpenIdUtil generates default User_xxxxxx identities, reads from smyx-api-key.txt, and falls back to local DB lookup — all silently. SKILL.md section on 'user identity handling' describes it as automatic but omits these resolution mechanisms.

skills/smyx_common/scripts/util.py:217

Document all identity resolution steps: file read, DB fallback, auto-generation.

Medium Priv Escalation

Undeclared environment variable access

ConstantEnum.init() reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID from os.environ without declaration. This allows the skill to receive and use identity from external sources.

skills/smyx_common/scripts/config.py:367

Declare environment variable access in SKILL.md resource section.

Medium Doc Mismatch

Local database writes undeclared

SKILL.md nowhere mentions database access. The skill creates tables and stores user identity, tokens, and open_tokens in a SQLite database at the agent workspace data directory.

skills/smyx_common/scripts/dao.py:199

Declare database:WRITE capability and document what data is stored locally.

Medium Data Exfil

Pet video upload to external domain without explicit consent flow

The skill uploads video files to lifeemergence.com API endpoints. SKILL.md mentions 'cloud API' but does not clearly disclose that raw pet video data is sent to an external third-party service with user tokens attached.

skills/smyx_analysis/scripts/skill.py:72

Add explicit data handling disclosure: what leaves the system, to which endpoints, and with what credentials.

Low Supply Chain

Unpinned requests dependency

requirements.txt specifies requests>=2.28.0 without upper bound. requests <2.32.0 has known CVE-2024-35195 (deserialization of proxy credentials). The skill uses requests throughout for all HTTP communication.

skills/smyx_analysis/requirements.txt:1

Pin to requests>=2.32.0 to address CVE-2024-35195.

Low Doc Mismatch

Plaintext HTTP development endpoints in artifact

config-dev.yaml contains HTTP plaintext endpoints (192.168.1.234). While this is dev-only, including it in the published artifact means credentials may transit plaintext if this config is accidentally activated.

skills/smyx_common/scripts/config-dev.yaml:2

Remove dev config from published artifact, or ensure it is never loaded in production.

Low Sensitive Access

Silent file write to user-specified path

The --output flag writes analysis results to arbitrary filesystem paths chosen by the caller without scope restrictions or declared path boundaries.

scripts/smyx_respiratory_rate_abnormal_detect_analysis.py:91

Declare filesystem:WRITE scope and consider path boundary restrictions.

Declared capability vs actual capability

Filesystem Block

Declared READ

→

Inferred READ+WRITE

scripts/smyx_analysis.py:93 writes to args.output path; skills/smyx_common/scripts/dao.py:55 writes SQLite DB to workspace data dir

Network Block

Declared READ

→

Inferred READ+WRITE

skills/smyx_common/scripts/util.py:180 sends POST/GET requests with tokens to external API; SKILL.md describes only API calls but never mentions token exfiltration risk

Environment Block

Declared NONE

→

Inferred READ

skills/smyx_common/scripts/config.py:367 reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID from os.environ

Database Block

Declared NONE

→

Inferred READ+WRITE

skills/smyx_common/scripts/dao.py:61 creates and writes to SQLite database at workspace data dir; completely undeclared in SKILL.md

Shell Pass

Declared NONE

→

Inferred NONE

No subprocess, os.system, or shell execution found

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:38

Medium External URL

https://clawhub.ai/user/smyx-sunjinhui

skill-card.md:9

Medium External URL

https://clawhub.ai/smyx-sunjinhui/skills/smyx-respiratory-rate-abnormal-detect-analysis

skill-card.md:39

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	requirements.txt	Yes	No upper bound; requests <2.32.0 affected by CVE-2024-35195 (deserialization of proxy credentials). Should pin to >=2.32.0.
sqlalchemy	`*`	implicit (imported in dao.py)	No	No version constraint; unpinned dependency.
pydash	`*`	implicit (imported in util.py)	No	No version constraint; optional import with fallback.
pyyaml	`*`	implicit (imported in config.py)	No	skill-card.md flags PyYAML dependency issue but no version constraint specified.

File composition

31 files · 2711 lines

Python 18 files · 2363 linesMarkdown 4 files · 308 linesYAML 6 files · 29 linesText 2 files · 6 linesJSON 1 files · 5 lines

Files of concern · 7

skills/smyx_common/scripts/util.py Python · 718 lines

Silent user identity auto-creation not declared

skills/smyx_common/scripts/config.py Python · 399 lines

Undeclared environment variable access

skills/smyx_common/scripts/dao.py Python · 499 lines

Undisclosed local SQLite token storage · Local database writes undeclared

SKILL.md Markdown · 209 lines

https://lifeemergence.com/sample.html

skills/smyx_analysis/scripts/skill.py Python · 175 lines

Pet video upload to external domain without explicit consent flow

scripts/smyx_respiratory_rate_abnormal_detect_analysis.py Python · 102 lines

Silent file write to user-specified path

skill-card.md Markdown · 60 lines

https://clawhub.ai/user/smyx-sunjinhui · https://clawhub.ai/smyx-sunjinhui/skills/smyx-respiratory-rate-abnormal-detect-analysis

Other files · smyx_analysis.py · api_service.py · skill.py · api_service.py · config.py

31 files · 110.3 KB · 2711 lines

Python 18f · 2363LMarkdown 4f · 308LYAML 6f · 29LText 2f · 6LJSON 1f · 5L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 704 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 77 B

│ ├─ 🐍 config.py Python 24L · 701 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 591 B

│ └─ 🐍 smyx_respiratory_rate_abnormal_detect_analysis.py Python 102L · 3.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 209L · 12.9 KB

├─ 📋 _meta.json JSON 5L · 165 B

└─ 📝 skill-card.md Markdown 60L · 2.4 KB

Security positives

No reverse shell, C2 communication, or command execution vectors detected

No base64-encoded or obfuscated code present

No credential harvesting from ~/.ssh, ~/.aws, or .env files

No curl|bash or wget|sh remote script execution

No hidden instructions in HTML comments or documentation

API endpoints are HTTPS in production config (config.yaml)

skill-card.md correctly identifies and discloses known risks including the PyYAML dependency issue and plaintext dev endpoints

User identity is not exposed in skill output or error messages

File validation includes size and format checks before processing