中文 EN
开始可信审查
安全决策报告

smyx-aggressive-behavior-detection-analysis

Skill contains hidden subprocess capability and undeclared local credential storage that are not documented in SKILL.md, representing shadow functionality and undeclared resource access.

安装决策优先 来源: ClawHub 扫描时间: 2026/9/20
文件 31
IOC 12
越权项 4
发现 4
最直接的威胁证据
01
Skill presents as livestock behavior detection tool through SKILL.md 初始入口 · SKILL.md
02
Hidden ai_chat method exists with commented subprocess capability 权限提升 · skills/smyx_common/scripts/skill.py
03
Creates local SQLite database storing authentication tokens 持久化 · skills/smyx_common/scripts/dao.py

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 4 项声明之外的能力或越权行为。

复核
隐藏执行与外联

提取到 12 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 4 步攻击链，另有 0 项高危或严重发现。

复核
依赖与供应链卫生

发现 3 项需要关注的依赖或供应链线索。

攻击链

01
Skill presents as livestock behavior detection tool through SKILL.md

初始入口 · SKILL.md:1

02
Hidden ai_chat method exists with commented subprocess capability

权限提升 · skills/smyx_common/scripts/skill.py:38

03
Creates local SQLite database storing authentication tokens

持久化 · skills/smyx_common/scripts/dao.py:54

04
User identity and API tokens stored without user consent in documentation

最终危害 · skills/smyx_common/scripts/util.py:245

风险分是怎么被拉高的

Undocumented subprocess capability +20

ai_chat method with commented-out openclaw agent execution exists in smyx_common/scripts/skill.py but is not declared in SKILL.md

Undeclared database storage +15

Creates SQLite database at workspace data directory storing user tokens and API credentials without disclosure in documentation

Environment variable access +10

Reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID from environment without declaration

最关键的证据

中危 文档欺骗

Undocumented subprocess capability in ai_chat method

The smyx_common/scripts/skill.py contains an ai_chat method with fully commented-out but structurally intact subprocess execution code for running 'openclaw agent' commands. This shadow functionality is not mentioned in SKILL.md.

skills/smyx_common/scripts/skill.py:38
Remove the commented subprocess code if not needed, or document this capability in SKILL.md with clear use cases and security implications.
中危 敏感访问

Undeclared local SQLite database for credential storage

The skill creates a SQLite database (smyx-common-claw.db) in the workspace data directory that stores user records including username, token, open_token, and realname. This persistent storage mechanism is not disclosed in documentation.

skills/smyx_common/scripts/dao.py:1
Document the local database storage in SKILL.md, specifying what data is stored and where, and provide guidance on cleanup procedures.
低危 敏感访问

Undocumented environment variable access

The skill reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, and FEISHU_OPEN_ID from environment variables for user identity resolution. This behavior is not declared in SKILL.md.

skills/smyx_common/scripts/config.py:168
Document which environment variables the skill accesses and for what purpose.
低危 凭证窃取

Automatic user identity creation and token storage

The OpenIdUtil class automatically generates default user identities (User_xxxxxx format) if no identity is provided, and stores authentication tokens in both memory and local SQLite database.

skills/smyx_common/scripts/util.py:245
Clarify the identity creation mechanism and ensure users understand that tokens are stored locally.

声明能力 vs 实际能力

文件系统 阻止
声明 NONE
→
推断 WRITE
dao.py:54-150 - Creates SQLite database files in workspace data directory
网络访问 通过
声明 READ
→
推断 READ
Multiple HTTP POST/GET requests to lifeemergence.com APIs
命令执行 阻止
声明 NONE
→
推断 ADMIN
skill.py:38-54 - ai_chat method contains commented-out subprocess.run executing openclaw agent commands
环境变量 阻止
声明 NONE
→
推断 READ
config.py:168-175 - Reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID
数据库 阻止
声明 NONE
→
推断 WRITE
dao.py - SQLite ORM storing sys_user table with token, open_token, username fields

可疑产物与外联

中危 外部 URL
https://lifeemergence.com/sample.html

SKILL.md:29

中危 外部 URL
https://clawhub.ai/user/18072937735

skill-card.md:9

中危 外部 URL
https://clawhub.ai/18072937735/skills/smyx-aggressive-behavior-detection-analysis

skill-card.md:39

中危 外部 URL
http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

中危 外部 URL
http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

中危 外部 URL
http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

中危 外部 URL
https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

中危 外部 URL
http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

中危 外部 URL
https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

中危 外部 URL
https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

中危 外部 URL
https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

中危 外部 URL
http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

依赖与供应链

包名版本来源漏洞备注
requests >=2.28.0 pip 否 Lower bound only, no upper cap
pydash 8.0.6 pip 否 Version pinned
SQLAlchemy 2.0.46 pip 否 Version pinned
PyYAML 6.0.3 pip 否 Version pinned

文件构成

31 个文件 · 2763 行
Python 18 个文件 · 2363 行Markdown 4 个文件 · 360 行YAML 6 个文件 · 29 行Text 2 个文件 · 6 行JSON 1 个文件 · 5 行
需关注文件 · 6
skills/smyx_common/scripts/util.py Python · 718 行
Automatic user identity creation and token storage
skills/smyx_common/scripts/config.py Python · 399 行
Undocumented environment variable access
skills/smyx_common/scripts/dao.py Python · 499 行
Undeclared local SQLite database for credential storage
SKILL.md Markdown · 261 行
https://lifeemergence.com/sample.html
skill-card.md Markdown · 60 行
https://clawhub.ai/user/18072937735 · https://clawhub.ai/18072937735/skills/smyx-aggressive-behavior-detection-analysis
skills/smyx_common/scripts/skill.py Python · 85 行
Undocumented subprocess capability in ai_chat method
其他文件 · skill.py · smyx_analysis.py · smyx_aggressive_behavior_detection_analysis.py · api_service.py · api_service.py · config.py

安全亮点

No active malicious code execution observed - subprocess code is commented out
API endpoints are hardcoded to legitimate domains (lifeemergence.com)
No base64 obfuscation or suspicious encoding patterns found
No direct IP network requests or C2 communication patterns
Dependencies are version-pinned (pydash==8.0.6, SQLAlchemy==2.0.46)
No credential exfiltration to external servers beyond declared API endpoints
Local database path is restricted to workspace data directory
HTTP requests use proper authentication headers (X-Access-Token, Authorization)