中文 EN
Start Review
Skill Trust Decision

fire-detection-analysis

火情烟雾检测技能为合法AI分析工具，具有完整的文档说明，但存在注释掉的subprocess代码和依赖无版本锁定等轻微瑕疵。

Install decision first Source: ClawHub Scanned: Jul 6, 2026
Files 29
Artifacts 10
Violations 2
Findings 4

Why this conclusion was reached

1/4 dimensions flagged
Block
Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

注释掉的subprocess代码 +5

skills/smyx_common/scripts/skill.py中存在被注释的subprocess.run调用，未实际执行

依赖无版本锁定 +10

skills/smyx_analysis/requirements.txt中requests>=2.28.0使用范围版本

本地数据库存储 +5

skills/smyx_common/scripts/dao.py使用SQLite存储用户身份信息，用于身份持久化

Most important evidence

Low Supply Chain

依赖包版本未锁定

requirements.txt中使用范围版本指定依赖（如requests>=2.28.0），可能导致安装不同版本引入潜在风险

skills/smyx_analysis/requirements.txt:1
建议锁定具体版本，如requests==2.31.0
Low Obfuscation

注释掉的subprocess代码

skills/smyx_common/scripts/skill.py中存在被注释的subprocess.run调用（ai_chat方法），虽未实际执行但属于阴影功能

skills/smyx_common/scripts/skill.py:30
如不需要此功能建议直接删除注释代码
Low Priv Escalation

本地数据库存储用户身份

使用SQLite本地数据库存储用户token、open_token等凭证信息，用于身份持久化和复用

skills/smyx_common/scripts/dao.py:1
这是合法功能设计，用于用户身份管理，无需删除但需确保数据库文件安全
Low Doc Mismatch

声明权限与实际能力存在差异

SKILL.md未声明本地数据库写入能力和结果文件输出能力，但代码实际使用了这些功能

scripts/fire_detection_analysis.py:66
建议在SKILL.md文档中补充说明本地文件写入能力（用于保存分析结果）

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred READ
skills/smyx_analysis/scripts/skill.py:91-97 文件读取
Filesystem Block
Declared NONE
→
Inferred WRITE
scripts/fire_detection_analysis.py:66 本地文件写入用于结果保存
Network Pass
Declared READ
→
Inferred READ
skills/smyx_common/scripts/util.py:305-314 HTTP请求到API端点
Shell Pass
Declared NONE
→
Inferred NONE
skills/smyx_common/scripts/skill.py:30-45 subprocess代码被注释
Database Block
Declared NONE
→
Inferred WRITE
skills/smyx_common/scripts/dao.py:1-10 SQLite用户数据库

Suspicious artifacts and egress

Medium External URL
https://lifeemergence.com/sample.html

SKILL.md:33

Medium External URL
http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL
http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL
http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL
https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL
http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL
https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL
https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL
https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL
http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
requests >=2.28.0 pip No 无版本锁定，建议锁定具体版本
pydash 8.0.6 pip No 版本已锁定
SQLAlchemy 2.0.46 pip No 版本已锁定
yaml 6.0.3 pip No 版本已锁定

File composition

29 files · 2609 lines
Python 18 files · 2353 linesMarkdown 3 files · 221 linesYAML 6 files · 29 linesText 2 files · 6 lines
Files of concern · 4
skills/smyx_common/scripts/dao.py Python · 499 lines
本地数据库存储用户身份
SKILL.md Markdown · 181 lines
https://lifeemergence.com/sample.html
scripts/fire_detection_analysis.py Python · 96 lines
声明权限与实际能力存在差异
skills/smyx_common/scripts/skill.py Python · 85 lines
注释掉的subprocess代码
Other files · util.py · config.py · skill.py · smyx_analysis.py · api_service.py · api_service.py +2

Security positives

代码结构清晰，模块化设计良好
有完整的中英文文档说明
使用标准库和成熟依赖（requests、SQLAlchemy）
API调用有完整的认证机制
未发现恶意行为或数据外泄
支持文件类型和大小验证
错误处理完善