安全决策报告

smyx-respiratory-rate-abnormal-detect-analysis

Name: smyx-respiratory-rate-abnormal-detect-analysis 可信度判断报告
Item: smyx-respiratory-rate-abnormal-detect-analysis
Rating: 55
Author: ClawSafe

The skill performs legitimate pet respiratory monitoring via video analysis but has multiple undisclosed behaviors: silent user identity creation/stored in local SQLite, auto-resolution of identity from environment variables, and local database writes not declared in SKILL.md. Additionally, development plaintext HTTP endpoints are present, and dependency pinning is absent.

安装决策优先来源: ClawHub 扫描时间: 2026/9/14

文件 31

IOC 12

越权项 4

发现 8

最直接的威胁证据

为什么得出这个结论

1/4 个维度触发

阻止

声明与实际能力

发现 4 项声明之外的能力或越权行为。

复核

隐藏执行与外联

提取到 12 个一般风险产物，需要结合上下文判断。

通过

攻击链与高危发现

没有形成明确的恶意路径。

复核

依赖与供应链卫生

发现 4 项需要关注的依赖或供应链线索。

风险分是怎么被拉高的

Undisclosed local SQLite token storage +15

SKILL.md nowhere mentions that user tokens, open_tokens, and user records are stored in a local SQLite database (smyx-common-claw.db). This is a hidden persistent state mechanism.

Silent user identity creation and auto-resolution +10

OpenIdUtil auto-generates User_xxxxxx identities, reads smyx-api-key.txt, and queries/modifies local DB — none of which are declared in SKILL.md user identity handling section.

Undeclared environment variable access +5

ConstantEnum.init() reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHu_OPEN_ID from os.environ — not declared in SKILL.md.

Plaintext HTTP development endpoints +5

config-dev.yaml contains HTTP plaintext endpoints (192.168.1.234) — skill-card.md acknowledges this as a known risk but SKILL.md does not.

Unpinned requests dependency +5

requirements.txt specifies requests>=2.28.0 without upper bound; older versions have known vulnerabilities.

Silent file write to user-specified path +5

The --output flag writes arbitrary content to user-specified filesystem paths without declared scope limits.

最关键的证据

中危文档欺骗

Undisclosed local SQLite token storage

SKILL.md describes 'automatic internal identity handling' but never mentions that tokens, open_tokens, and user records are persisted to a local SQLite database (smyx-common-claw.db) in the agent's data directory. This is hidden persistent state.

skills/smyx_common/scripts/dao.py:61

Declare local token persistence in SKILL.md. Users should know that credentials are cached locally.

中危文档欺骗

Silent user identity auto-creation not declared

OpenIdUtil generates default User_xxxxxx identities, reads from smyx-api-key.txt, and falls back to local DB lookup — all silently. SKILL.md section on 'user identity handling' describes it as automatic but omits these resolution mechanisms.

skills/smyx_common/scripts/util.py:217

Document all identity resolution steps: file read, DB fallback, auto-generation.

中危权限提升

Undeclared environment variable access

ConstantEnum.init() reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID from os.environ without declaration. This allows the skill to receive and use identity from external sources.

skills/smyx_common/scripts/config.py:367

Declare environment variable access in SKILL.md resource section.

中危文档欺骗

Local database writes undeclared

SKILL.md nowhere mentions database access. The skill creates tables and stores user identity, tokens, and open_tokens in a SQLite database at the agent workspace data directory.

skills/smyx_common/scripts/dao.py:199

Declare database:WRITE capability and document what data is stored locally.

中危数据外泄

Pet video upload to external domain without explicit consent flow

The skill uploads video files to lifeemergence.com API endpoints. SKILL.md mentions 'cloud API' but does not clearly disclose that raw pet video data is sent to an external third-party service with user tokens attached.

skills/smyx_analysis/scripts/skill.py:72

Add explicit data handling disclosure: what leaves the system, to which endpoints, and with what credentials.

低危供应链

Unpinned requests dependency

requirements.txt specifies requests>=2.28.0 without upper bound. requests <2.32.0 has known CVE-2024-35195 (deserialization of proxy credentials). The skill uses requests throughout for all HTTP communication.

skills/smyx_analysis/requirements.txt:1

Pin to requests>=2.32.0 to address CVE-2024-35195.

低危文档欺骗

Plaintext HTTP development endpoints in artifact

config-dev.yaml contains HTTP plaintext endpoints (192.168.1.234). While this is dev-only, including it in the published artifact means credentials may transit plaintext if this config is accidentally activated.

skills/smyx_common/scripts/config-dev.yaml:2

Remove dev config from published artifact, or ensure it is never loaded in production.

低危敏感访问

Silent file write to user-specified path

The --output flag writes analysis results to arbitrary filesystem paths chosen by the caller without scope restrictions or declared path boundaries.

scripts/smyx_respiratory_rate_abnormal_detect_analysis.py:91

Declare filesystem:WRITE scope and consider path boundary restrictions.

声明能力 vs 实际能力

文件系统 阻止

声明 READ

→

推断 READ+WRITE

scripts/smyx_analysis.py:93 writes to args.output path; skills/smyx_common/scripts/dao.py:55 writes SQLite DB to workspace data dir

网络访问 阻止

声明 READ

→

推断 READ+WRITE

skills/smyx_common/scripts/util.py:180 sends POST/GET requests with tokens to external API; SKILL.md describes only API calls but never mentions token exfiltration risk

环境变量 阻止

声明 NONE

→

推断 READ

skills/smyx_common/scripts/config.py:367 reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID from os.environ

数据库 阻止

声明 NONE

→

推断 READ+WRITE

skills/smyx_common/scripts/dao.py:61 creates and writes to SQLite database at workspace data dir; completely undeclared in SKILL.md

命令执行 通过

声明 NONE

→

推断 NONE

No subprocess, os.system, or shell execution found

可疑产物与外联

中危外部 URL

https://lifeemergence.com/sample.html

SKILL.md:38

中危外部 URL

https://clawhub.ai/user/smyx-sunjinhui

skill-card.md:9

中危外部 URL

https://clawhub.ai/smyx-sunjinhui/skills/smyx-respiratory-rate-abnormal-detect-analysis

skill-card.md:39

中危外部 URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

中危外部 URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

中危外部 URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

中危外部 URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

中危外部 URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

中危外部 URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

中危外部 URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

中危外部 URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

中危外部 URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

依赖与供应链

包名	版本	来源	漏洞	备注
requests	`>=2.28.0`	requirements.txt	是	No upper bound; requests <2.32.0 affected by CVE-2024-35195 (deserialization of proxy credentials). Should pin to >=2.32.0.
sqlalchemy	`*`	implicit (imported in dao.py)	否	No version constraint; unpinned dependency.
pydash	`*`	implicit (imported in util.py)	否	No version constraint; optional import with fallback.
pyyaml	`*`	implicit (imported in config.py)	否	skill-card.md flags PyYAML dependency issue but no version constraint specified.

文件构成

31 个文件 · 2711 行

Python 18 个文件 · 2363 行Markdown 4 个文件 · 308 行YAML 6 个文件 · 29 行Text 2 个文件 · 6 行JSON 1 个文件 · 5 行

需关注文件 · 7

skills/smyx_common/scripts/util.py Python · 718 行

Silent user identity auto-creation not declared

skills/smyx_common/scripts/config.py Python · 399 行

Undeclared environment variable access

skills/smyx_common/scripts/dao.py Python · 499 行

Undisclosed local SQLite token storage · Local database writes undeclared

SKILL.md Markdown · 209 行

https://lifeemergence.com/sample.html

skills/smyx_analysis/scripts/skill.py Python · 175 行

Pet video upload to external domain without explicit consent flow

scripts/smyx_respiratory_rate_abnormal_detect_analysis.py Python · 102 行

Silent file write to user-specified path

skill-card.md Markdown · 60 行

https://clawhub.ai/user/smyx-sunjinhui · https://clawhub.ai/smyx-sunjinhui/skills/smyx-respiratory-rate-abnormal-detect-analysis

其他文件 · smyx_analysis.py · api_service.py · skill.py · api_service.py · config.py

31 文件 · 110.3 KB · 2711 行

Python 18f · 2363LMarkdown 4f · 308LYAML 6f · 29LText 2f · 6LJSON 1f · 5L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 20L · 704 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 77 B

│ ├─ 🐍 config.py Python 24L · 701 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 591 B

│ └─ 🐍 smyx_respiratory_rate_abnormal_detect_analysis.py Python 102L · 3.5 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

├─ 📝 SKILL.md Markdown 209L · 12.9 KB

├─ 📋 _meta.json JSON 5L · 165 B

└─ 📝 skill-card.md Markdown 60L · 2.4 KB

安全亮点

No reverse shell, C2 communication, or command execution vectors detected

No base64-encoded or obfuscated code present

No credential harvesting from ~/.ssh, ~/.aws, or .env files

No curl|bash or wget|sh remote script execution

No hidden instructions in HTML comments or documentation

API endpoints are HTTPS in production config (config.yaml)

skill-card.md correctly identifies and discloses known risks including the PyYAML dependency issue and plaintext dev endpoints

User identity is not exposed in skill output or error messages

File validation includes size and format checks before processing