Skill Trust Decision

smyx-fish-color-brightness-assessment-analysis

Name: smyx-fish-color-brightness-assessment-analysis Trust Review Report
Item: smyx-fish-color-brightness-assessment-analysis
Rating: 80
Author: ClawSafe

合法的观赏鱼体色鲜艳度评估技能，存在被注释的阴影功能代码但无实际执行风险，依赖版本基本锁定，整体安全可用

Install decision first Source: ClawHub Scanned: 26 days ago

Files 29

Artifacts 10

Violations 0

Findings 3

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

阴影功能代码残留 +10

skills/smyx_common/scripts/skill.py 中保留了 ai_chat 方法调用 subprocess 的注释代码，但已被注释不会执行

依赖版本未完全锁定 +5

smyx_analysis 的 requirements.txt 中 requests>=2.28.0 使用范围版本

文档未声明本地存储 +5

SKILL.md 未说明使用本地 SQLite 数据库存储用户身份信息

Most important evidence

Low Doc Mismatch

阴影功能代码残留

skills/smyx_common/scripts/skill.py 中存在 ai_chat 方法，包含通过 subprocess 调用 openclaw agent 的代码逻辑，虽然已被注释但代码结构完整，暗示存在未声明的远程命令执行能力

skills/smyx_common/scripts/skill.py:35

确认为调试遗留代码后删除，或明确在 SKILL.md 中声明此功能的用途和触发条件

Low Supply Chain

依赖版本未完全锁定

smyx_analysis/requirements.txt 中 requests>=2.28.0 使用范围版本，存在潜在供应链风险

skills/smyx_analysis/requirements.txt:1

建议锁定具体版本如 requests==2.31.0

Low Sensitive Access

本地数据库存储用户身份

使用本地 SQLite 数据库存储用户身份信息（username, token, open_token），但 SKILL.md 未声明此本地存储行为

skills/smyx_common/scripts/dao.py:1

在 SKILL.md 的数据处理部分补充说明本地数据库存储机制

Declared capability vs actual capability

Filesystem Pass

Declared READ

→

Inferred READ

smyx_analysis.py:61-68 读取本地图像文件上传到API

Network Pass

Declared READ

→

Inferred READ

util.py:322-365 HTTP请求到外部API服务

Database Pass

Declared NONE

→

Inferred WRITE

dao.py 本地SQLite存储用户身份，但SKILL.md未声明

Suspicious artifacts and egress

Medium External URL

https://lifeemergence.com/sample.html

SKILL.md:34

Medium External URL

http://192.168.1.234:9601/smyx-open-api

skills/smyx_common/scripts/config-dev.yaml:2

Medium External URL

http://192.168.1.234:4100

skills/smyx_common/scripts/config-dev.yaml:3

Medium External URL

http://192.168.1.234:7070/jeecg-boot-xzgz

skills/smyx_common/scripts/config-dev.yaml:4

Medium External URL

https://livemonitortest.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config-test.yaml:2

Medium External URL

http://livemonitortest.lifeemergence.com

skills/smyx_common/scripts/config-test.yaml:3

Medium External URL

https://healthtest.lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config-test.yaml:4

Medium External URL

https://lifeemergence.com/jeecg-boot-xzgz

skills/smyx_common/scripts/config.yaml:4

Medium External URL

https://open.lifeemergence.com/smyx-open-api

skills/smyx_common/scripts/config.yaml:5

Medium External URL

http://livemonitor.lifeemergence.com

skills/smyx_common/scripts/config.yaml:6

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`>=2.28.0`	pip	No	范围版本，建议锁定
pydash	`8.0.6`	pip	No	版本锁定
SQLAlchemy	`2.0.46`	pip	No	版本锁定
PyYAML	`6.0.3`	pip	No	版本锁定

File composition

29 files · 2745 lines

Python 18 files · 2364 linesMarkdown 3 files · 346 linesYAML 6 files · 29 linesText 2 files · 6 lines

Files of concern · 3

SKILL.md Markdown · 205 lines

https://lifeemergence.com/sample.html

skills/smyx_common/scripts/dao.py Python · 499 lines

本地数据库存储用户身份

skills/smyx_common/scripts/skill.py Python · 85 lines

阴影功能代码残留

Other files · util.py · config.py · api_doc.md · skill.py · smyx_analysis.py · smyx_fish_color_brightness_assessment_analysis.py +3

29 files · 120.3 KB · 2745 lines

Python 18f · 2364LMarkdown 3f · 346LYAML 6f · 29LText 2f · 6L

├─ ▾ 📁 references

│ └─ 📝 api_doc.md Markdown 122L · 7.3 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 __init__.py Python 1L · 62 B

│ ├─ 🐍 config.py Python 24L · 691 B

│ ├─ 📋 config.yaml YAML 1L · 3 B

│ ├─ 🐍 skill.py Python 23L · 579 B

│ └─ 🐍 smyx_fish_color_brightness_assessment_analysis.py Python 103L · 3.7 KB

├─ ▾ 📁 skills

│ ├─ ▾ 📁 smyx_analysis

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api_doc.md Markdown 19L · 427 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 __init__.py Python 0 B

│ │ │ ├─ 🐍 api_service.py Python 40L · 1.5 KB

│ │ │ ├─ 🐍 config.py Python 39L · 1003 B

│ │ │ ├─ 📋 config.yaml YAML 1L · 3 B

│ │ │ ├─ 🐍 skill.py Python 175L · 6.4 KB

│ │ │ └─ 🐍 smyx_analysis.py Python 115L · 3.7 KB

│ │ ├─ 🐍 __init__.py Python 0 B

│ │ └─ 📄 requirements.txt Text 3L · 45 B

│ └─ ▾ 📁 smyx_common

│ ├─ ▾ 📁 scripts

│ │ ├─ 🐍 __init__.py Python 9L · 177 B

│ │ ├─ 🐍 api_service.py Python 101L · 2.6 KB

│ │ ├─ 🐍 base.py Python 33L · 469 B

│ │ ├─ 📋 config-dev.yaml YAML 6L · 214 B

│ │ ├─ 📋 config-prod.yaml YAML 0 B

│ │ ├─ 📋 config-test.yaml YAML 6L · 256 B

│ │ ├─ 🐍 config.py Python 399L · 23.8 KB

│ │ ├─ 📋 config.yaml YAML 15L · 473 B

│ │ ├─ 🐍 dao.py Python 499L · 17.8 KB

│ │ ├─ 🐍 skill.py Python 85L · 2.4 KB

│ │ └─ 🐍 util.py Python 718L · 28.1 KB

│ ├─ 🐍 __init__.py Python 0 B

│ └─ 📄 requirements.txt Text 3L · 47 B

└─ 📝 SKILL.md Markdown 205L · 18.6 KB

Security positives

核心功能代码结构清晰，API调用逻辑正常

smyx_common 依赖版本完全锁定（pydash==8.0.6, SQLAlchemy==2.0.46, PyYAML==6.0.3）

数据库路径强制重定向到工作区共享 data 目录，防止污染

使用环境变量读取身份信息（OPENCLAW_SENDER_OPEN_ID等），不硬编码凭证

HTTP请求包含超时设置（DEFAULT__REQUEST_TIMEOUT=120s）

无明显的凭证收割、远程代码执行或数据外泄行为