Skill Trust Decision

psychological-stress-assessment-analysis

Name: psychological-stress-assessment-analysis Trust Review Report
Item: psychological-stress-assessment-analysis
Rating: 80
Author: ClawSafe

心理压力评估技能，代码实现为云端API调用工具，凭证管理通过本地数据库实现，但缺少必要的权限声明和敏感操作文档说明。

Install decision first Source: ClawHub Scanned: Aug 20, 2026

Files 29

Artifacts 10

Violations 4

Findings 3

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

未声明本地数据库操作 +8

OpenIdUtil创建本地SQLite数据库smyx-common-claw.db存储用户凭证，SKILL.md未提及

未声明外部凭证传输 +7

RequestUtil.http_request将token/open_token发送到外部API，文档未说明

开发环境内网IP暴露 +5

config-dev.yaml包含192.168.1.234等内网地址

Most important evidence

Medium Doc Mismatch

本地用户身份管理未声明

OpenIdUtil类实现了完整的用户身份生命周期管理：生成默认用户名(User_xxxxxx)、读写本地数据库、持久化token。SKILL.md仅说'系统内部自动处理'，未提及本地数据库创建和凭证存储行为。

skills/smyx_common/scripts/util.py:280

在SKILL.md的'前置准备'或'资源索引'章节补充说明：本技能需要本地数据库存储会话信息，路径为工作区data/smyx-common-claw.db

Medium Sensitive Access

凭证自动注册机制暴露手机号处理

RequestUtil._get_or_create_user函数在认证失败时会自动调用/sys/phoneLogin接口，使用username作为mobile参数进行静默注册，可能涉及手机号处理逻辑。

skills/smyx_common/scripts/util.py:160

确认username参数来源，确保不意外将用户手机号作为mobile提交。建议仅在明确用户同意的情况下使用静默注册。

Low Supply Chain

requests依赖无版本上限

requirements.txt中requests>=2.28.0只有下限没有上限，可能安装到存在已知漏洞的更新版本。

scripts/psychological_stress_assessment_analysis.py:10

建议锁定版本上限，如requests>=2.28.0,<2.32.0

Declared capability vs actual capability

Filesystem Block

Declared NONE

→

Inferred READ

scripts/psychological_stress_assessment_analysis.py:38-46 文件存在性和可读性检查

Filesystem Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:53-54 创建SQLite数据库文件

Network Block

Declared NONE

→

Inferred ADMIN

skills/smyx_common/scripts/util.py:200-210 携带X-Access-Token/X-Api-Key发送认证请求到外部API

Database Block

Declared NONE

→

Inferred WRITE

skills/smyx_common/scripts/dao.py:150-180 UserDao实现完整的CRUD操作

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:36

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	无版本上限，可能安装到有漏洞版本
pydash	`==8.0.6`	pip	No	已锁定版本
SQLAlchemy	`==2.0.46`	pip	No	已锁定版本
PyYAML	`==6.0.3`	pip	No	已锁定版本

File composition

29 files · 2716 lines

Python 18 files · 2471 linesMarkdown 3 files · 210 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 3

skills/smyx_common/scripts/util.py Python · 718 lines

本地用户身份管理未声明 · 凭证自动注册机制暴露手机号处理

SKILL.md Markdown · 170 lines

https://lifeemergence.com/sample.html

scripts/psychological_stress_assessment_analysis.py Python · 210 lines

requests依赖无版本上限

Other files · config.py · dao.py · skill.py · smyx_analysis.py · api_service.py · skill.py +3

29 files · 108.1 KB · 2716 lines

Python 18f · 2471LMarkdown 3f · 210LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 21L · 666 B

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 31 B

│ ├─ 🐍 config.py Python 24L · 667 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 psychological_stress_assessment_analysis.py Python 210L · 7.1 KB

│ └─ 🐍 skill.py Python 23L · 573 B

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 472 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

└─ 📝 SKILL.md Markdown 170L · 9.8 KB

Security positives

代码结构清晰，使用标准Python库和SQLAlchemy ORM

依赖版本基本锁定（pydash==8.0.6, SQLAlchemy==2.0.46）

无subprocess/shell执行，无base64/eval混淆

数据库路径强制重定向到工作区data目录，不会污染系统目录

AgentContextUtil实现了工作区隔离，防止子Agent污染主Agent数据