Bird Recognition Tool | 鸟类识别工具

Identifies bird species in images/videos of target areas. Supports recognition of no less than 500 common bird species, supports customized model training, s...

This skill is not an outright exploit, but several mismatches increase risk. Before installing or enabling it: - Verify the API endpoints: the bundled config defaults point to lifeemergence.com; if you don't trust that service, do not pass API keys or open-ids. - Do not provide sensitive credentials or production open-ids without reviewing where they are stored (skills/smyx_common/scripts/config.yaml and workspace-level config files). The skill expects an 'open-id' and will try to read workspace config files and environment variables. - Expect local persistence: the skill includes code that writes a SQLite DB to the workspace/data directory and may save attachments. If you need isolation, run it in a sandboxed workspace. - Review included files (smyx_common and face_analysis) — they expand the attack surface and are not strictly required for a minimal bird-recognition wrapper. If you only want image-to-API behavior, consider a slimmer alternative or extract/inspect the specific API-calling logic. - If you proceed, monitor network traffic and filesystem writes (where report export URLs point, what files are created), and avoid supplying secrets until you confirm where they are sent. If you want, I can: list the exact places the code reads/writes files and which environment variables it consults, or point out the exact lines that construct external URLs and local DB paths.

Type: OpenClaw Skill Name: smyx-bird-recognition-analysis Version: 1.0.0 The skill bundle is a bird recognition tool that interfaces with a cloud-based AI service (lifeemergence.com). It includes a comprehensive shared utility framework (smyx_common) for handling API authentication, local SQLite-based token caching, and multipart file uploads for image/video analysis. While SKILL.md contains 'Mandatory Memory Rules' that instruct the agent to ignore local memory files and prioritize cloud-fetched data, these appear to be functional constraints designed to ensure data consistency with the backend service rather than malicious prompt injection. The code follows a standard SDK pattern for commercial agent skills and lacks evidence of unauthorized data exfiltration or system compromise.