Plant Nutrition Diagnosis Skill | 植物营养诊断技能

Diagnoses plant nutrient deficiency or excess based on computer vision and plant physiology, outputs targeted fertilization suggestions for precision nutrien...

Before installing or running this skill: - Understand where images and reports will be sent: the code uses configured remote API endpoints (config files point to lifeemergence/open API URLs). If you will send sensitive images, confirm and trust the service endpoints and any API keys. - The SKILL.md forbids reading local memories but the code reads local config files and creates a local SQLite DB under the workspace/data directory; expect local persistence of metadata and possibly uploaded filenames — review skills/smyx_common/scripts/config.yaml and the DAO behavior. - The package bundles a separate face-analysis skill and a large requirements list (smyx_common). This is likely code reuse but increases dependency surface; consider running in a sandboxed environment and inspect/lock down network access before giving it real data. - The skill enforces acquiring an open-id from local config or user input. Do not provide highly privileged secrets; if asked for api-key values, verify their purpose and target service. - If you need a lower-risk test, run the supplied scripts with dummy inputs and capture network traffic (or run in an isolated network) to confirm which endpoints are contacted and what data is transmitted. Given the contradictions between the documented 'no local memory reads' rule and the code that reads/writes local config/DB, review and possibly request the maintainer clarify these behaviors before use.

Type: OpenClaw Skill Name: smyx-plant-nutrition-diagnosis-analysis Version: 1.0.0 The skill bundle provides plant nutrition diagnosis by analyzing images/videos via a remote API (lifeemergence.com). It utilizes a shared utility library (smyx_common) for handling API authentication, local SQLite-based session caching, and structured reporting. While SKILL.md contains high-priority instructions that force the agent to bypass local memory (LanceDB) in favor of the developer's cloud API and mandates the collection of a user identifier (open-id), these behaviors appear to be architectural choices for state synchronization rather than malicious exploitation. No evidence of unauthorized data exfiltration, credential theft, or harmful command execution was found.