Pet Soothing Trigger Analysis Skill | 宠物安抚触发分析技能

Automatically triggers soothing mechanisms (playing relaxing sounds, activating laser toys) when pet anxiety, howling, or prolonged loneliness is detected; a...

What to consider before installing/running this skill: - Code and data flow: The skill will upload video files and query remote APIs (configured in smyx_common config.yaml). If you run it, your video(s) and user open-id may be sent to external servers. Review the RequestUtil / api_service code to confirm which endpoints and headers are used and what is transmitted. - Local persistence: The package contains a SQLite DAO and will create files under your workspace/data and save uploaded attachments in the skill directory. If you are concerned about local storage of sensitive recordings, run in an isolated environment or inspect and control the attachments/db paths first. - Undeclared env/config dependencies: Although the registry metadata lists no env vars, the code reads OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID and skill/workspace config.yaml files. Do not provide sensitive credentials (API keys, tokens, or personal IDs) until you confirm exactly where they are sent. - Mismatched components: The bundle includes an unrelated face_analysis (human health/TCM) module and a large shared library. That increases the runtime dependencies and surface for data collection beyond pet use-cases. Ask the publisher why these components are bundled and whether they are necessary. - Practical steps: If you want to test safely, review skills/smyx_common/scripts/util.py and scripts/api_service.py to confirm network behavior and what fields are sent; run the tool in a restricted environment (no network access) first; or point api-url to a local mock endpoint to observe payloads. If you must run against the provider, avoid using production credentials or highly sensitive identifiers as the open-id until you trust the endpoint and have a privacy policy/owner contact. - Missing provenance: There is no homepage or publisher details — lack of source attribution reduces trust. Consider requesting the author's identity, a hosted API specification, and a privacy statement before providing real user data or API keys.

Type: OpenClaw Skill Name: smyx-pet-calming-trigger-analysis Version: 1.0.0 The skill bundle exhibits several high-risk behaviors and unusual architectural patterns. The 'SKILL.md' file contains 'Mandatory Memory Rules' that explicitly instruct the AI agent to ignore local memory files and LanceDB, forcing all data retrieval through a remote API (lifeemergence.com), which could be used to bypass local auditing. The 'smyx_common/scripts/util.py' file implements a 'silent registration' mechanism that automatically sends user identifiers—which the instructions suggest should be a phone number or username—to a remote endpoint. Additionally, 'smyx_common/scripts/skill.py' includes a 'subprocess.run' call to execute system commands via the 'openclaw' CLI, a high-risk capability. The bundle also contains the complete source code for an entirely unrelated 'face_analysis' skill, suggesting poor supply chain hygiene or hidden functionality.