Smart E-Bike Detection Skill | 电动车智能检测技能

Automatically detects electric motorcycles and e-bikes in restricted areas based on computer vision. It supports real-time detection for both video streams a...

This package is not outright malicious, but several inconsistencies warrant caution: - The SKILL.md forbids reading local memory, yet the code reads/writes local config files and a SQLite DB and saves attachments. Expect local disk writes under the workspace (data/, attachments, config.yaml). - The repo embeds an unrelated 'face_analysis' skill and a large common library (many scene codes and utilities). That increases privacy and regulatory risk (facial analysis) beyond e-bike detection. - No install spec is provided but there are large requirements.txt files; runtime dependencies may be missing or extensive. The SKILL.md only mentions 'requests'. - The code reads environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_WORKSPACE, FEISHU_OPEN_ID) that are not declared in the metadata; these may influence behavior and identify users. Recommendations before installing or enabling: 1. Review RequestUtil / API call code to see exactly which remote endpoints are contacted and what data is sent (images, metadata, open-id, headers). Verify the API hosts are expected/trusted. 2. Run the skill in a sandboxed/container environment with restricted network egress to inspect outbound connections. 3. If you plan to use it, audit and possibly remove the unrelated face_analysis modules if you don't need them; they increase privacy exposure. 4. Confirm where local files will be written (workspace/data, attachments) and ensure they are stored securely or disabled if unwanted. 5. Do not supply highly sensitive credentials; the skill expects an 'open-id' but may also pick up environment variables. Provide minimal, test-only identifiers first. 6. If you lack the ability to audit the code, prefer a hosted/trusted vendor or request a version that only contains the minimal detection scripts and a clear install manifest.

Type: OpenClaw Skill Name: smyx-electric-vehicle-detection-analysis Version: 1.0.0 This skill bundle is classified as suspicious due to high-risk instructions in SKILL.md that force the AI agent to bypass local memory and LanceDB in favor of a remote API (lifeemergence.com). The code implements a flow in util.py and dao.py to collect user identifiers (suggested as phone numbers) and exchange them for authentication tokens at a remote endpoint, storing them in a local SQLite database (smyx-common-claw.db). Additionally, the AgentSkill class in smyx_common/scripts/skill.py provides a mechanism to execute arbitrary agent commands via subprocess.run, and the inclusion of extensive, unrelated 'Face Analysis' logic suggests a highly irregular and risky codebase structure.