MiaoQIDS 🛡️量子防火墙-会做pcap文件分析的猫娘

量子入侵检测系统技能喵～ 基于经典-量子混合神经网络的入侵检测系统，可以分析网络流量数据（PCAP 文件），检测多种攻击类型，并为每种攻击提供置信度喵～ 提供安全防护建议喵。

Before installing or running this skill, consider the following: 1) Treat model files (cnn_mtd_final.pth, qnn_model.pkl, or other .pkl/.pth) as untrusted input — loading them uses pickle/torch.load which can execute arbitrary code. Only use models from a trusted source. 2) Inspect skill.py to confirm which host/interface the HTTP server binds to; prefer localhost-only binding and keep allowclients.txt restrictive to avoid exposing the analyzer. 3) Expect outbound network calls to ip-api.com for IP geolocation; if that is undesirable, modify/disable ip_query in code or replace with an offline database. 4) The code will create cache and result directories and save feature .npy files — ensure the cache path is acceptable and does not leak sensitive data. 5) The SKILL.md omitted important dependencies (pyqpanda3, pyvqnet, sklearn). Prepare to install these in a controlled environment (preferably isolated/air-gapped or containerized). 6) Run this skill in a sandboxed environment (VM/container) or with network egress controls until you are comfortable with its behavior, and audit any third-party model files you provide. 7) If you need higher assurance, request full startup script and the untruncated skill.py so you can confirm the server bind address and any remaining endpoints or behaviors.

Type: OpenClaw Skill Name: miao-qids Version: 0.1.1 The skill implements a complex hybrid classical-quantum intrusion detection system, but it contains several high-risk vulnerabilities and behaviors. It uses 'pickle.load' and 'torch.load' to load model data in 'CNNmodel.py', 'QNNmodel.py', and 'FeatureSelection.py', which are known vectors for Remote Code Execution (RCE) if model files are tampered with. The MCP server in 'skill.py' is an unauthenticated HTTP server that accepts arbitrary file paths ('pcap_path') from POST requests, which could be exploited to process sensitive system files. Additionally, 'skill.py' performs external network requests to 'ip-api.com' to geolocate IP addresses extracted from the analyzed traffic, constituting a potential data leak.