Plant Disease Recognition Skill | 植物病害识别技能

Accurately identifies plant diseases based on computer vision and deep learning, supports both image and video input, outputs structured diagnostic reports i...

This skill appears to implement a plant disease analyzer but includes a large shared library plus an unrelated 'face_analysis' feature, creates/updates local files (config.yaml, a SQLite DB under workspace/data), and uploads user images/videos to remote APIs (default base URLs present in the included config). Before installing or running it: 1) Confirm the remote API endpoints and operator (who runs lifeemergence.com or the configured API host) and read their privacy/data-retention policy — your images may be uploaded off-host. 2) Inspect skills/smyx_common/scripts/util.py (RequestUtil.http_post) to see exactly where and how data (files, open-id, API keys) are sent. 3) Decide whether you accept the skill creating files and a DB in your OPENCLAW_WORKSPACE; consider running in an isolated/sandboxed environment first. 4) Ask the publisher why face_analysis is bundled and why the skill declares no required credentials while expecting open-id/api-key values; request a minimal package that only contains the plant-disease logic. 5) Do not provide sensitive credentials; if the skill asks for an open-id, prefer a non-sensitive identifier and verify how that identifier is used and stored. If you need, request the skill author to: a) remove unrelated modules, b) explicitly declare required env vars/credentials and data flows, and c) provide a privacy/security statement describing remote endpoints and storage.

Type: OpenClaw Skill Name: smyx-plant-disease-recognition-analysis Version: 1.0.0 The skill bundle contains high-priority instructions in SKILL.md that command the AI agent to explicitly ignore local memory files and LanceDB storage, forcing a total reliance on external cloud APIs (lifeemergence.com). It utilizes a complex shared framework (smyx_common) that performs automated background user registration and stores session tokens in a local SQLite database (dao.py). Most notably, scripts/skill.py contains an AgentSkill class that uses subprocess.run to recursively invoke the 'openclaw' agent with arbitrary prompts, which is a high-risk capability for potential command chain injection.