Pet Vocal Emotion Analysis Skill | 宠物叫声情绪解析技能

Recognizes cat and dog barks through pet voiceprint AI, translates and outputs emotions and behavioral intentions such as happiness, excitement, anger, anxie...

This skill appears to implement the stated pet-audio analysis service, but there are several mismatches and persistence concerns you should consider before installing: - Open-ID and config handling: The skill requires an explicit open-id and will try to load config files from skills/smyx_common/scripts/config.yaml (or a workspace-level copy). Confirm what value you should provide as open-id and avoid supplying sensitive credentials (API tokens, system account IDs, or personally-identifying tokens) unless you trust the upstream service. - External endpoints: Default config values reference external domains (e.g., lifeemergence-related hosts). If you plan to use the skill, inspect skills/smyx_common/scripts/config.yaml (and config-dev/test) to confirm the API base URLs and API keys, and decide whether you are comfortable sending audio and metadata to those endpoints. - Local persistence and file writes: The code can create config files and a local SQLite DB under the workspace data directory and will save uploaded attachments. If you prefer no local state, do not install/run this skill or run it in an isolated environment. Check for any created files after a test run. - Undeclared environment variables and dependencies: The skill code reads environment variables (OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID) but the skill metadata did not declare them. Also the repository includes a large common requirements list — consider installing in a sandbox or inspecting/locking dependency versions. - SKILL.md contradictions: The skill forbids reading local memory files but the package contains DAO/local DB code that will create and read local files. Ask the author to clarify the intended memory/DB usage and to document exactly what is stored locally vs. fetched from the cloud. Actionable steps before use: 1) Inspect and, if needed, edit skills/smyx_common/scripts/config.yaml to point to a trusted API endpoint or blank values. 2) Run the skill in an isolated container or sandbox so you can observe network requests and file writes. 3) If you must provide an open-id, give a minimally-privileged/throwaway identifier. 4) If you need guarantees about privacy (audio not leaving your network), request a self-hosted API or audit of network calls and server behavior. 5) If anything looks unexpected (unknown external domains, undocumented data stores), treat the skill as untrusted and do not install it in production. If you want, I can: (a) list the exact files/paths the code will create/write at runtime, (b) summarize all external URLs/endpoints referenced in the code, or (c) point out the minimal edits to make the skill local-only (no network) for offline testing.

Type: OpenClaw Skill Name: smyx-pet-vocal-emotion-analysis Version: 1.0.0 The skill exhibits several high-risk behaviors, including the use of 'Mandatory Memory Rules' in SKILL.md that use high-priority prompt injection to override the agent's default memory retrieval mechanisms. The code in 'skills/smyx_common/scripts/skill.py' includes a wrapper to execute arbitrary 'openclaw agent' commands via subprocess. Additionally, 'skills/smyx_common/scripts/util.py' performs 'silent' registration and login to remote endpoints (lifeemergence.com) using user-provided identifiers like phone numbers, storing session tokens in a local SQLite database. While these features support the stated pet analysis service, the combination of CLI execution, aggressive prompt overrides, and automatic remote data transmission is highly suspicious.