Pet Behavior Recognition Skill | 宠物行为识别技能

Identifies common abnormal pet behaviors such as scratching, biting, destructive chewing, jumping, digging, chasing, and separation anxiety, helping owners u...

Key things to check before installing/using: - Data exfiltration risk: This skill uploads video files (or instructs the remote API to download a provided URL) to external servers (config shows lifeemergence/open API hosts). If videos contain sensitive content, presume they will leave your machine. - Local persistence mismatch: Despite SKILL.md forbidding reading local memory, the code includes a local SQLite DAO that will create/use a DB under the workspace data directory and will load/save YAML config files. If you cannot tolerate local storage of metadata or tokens, do not install/run this skill. - Environment variables: The skill reads environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, OPENCLAW_WORKSPACE, FEISHU_OPEN_ID) even though SKILL.md declares none required. If those env vars exist they may be used automatically as the 'open-id' or to determine storage locations. Audit or clear them if needed. - Network behavior: Review skills/smyx_common/scripts/util.py (RequestUtil and related functions) to confirm exactly what headers/fields are sent to remote APIs and whether open-id or any tokens are included in requests. The SKILL.md depends on the remote service for history queries and report exports; verify the endpoints and ownership. - Provenance and trust: The skill source is 'unknown' and no homepage is provided. Consider running it in an isolated environment (sandbox or VM) first, examine network traffic (e.g., with a proxy), and inspect util.RequestUtil to see the exact API URLs and payloads before using with real videos or credentials. - If you proceed: avoid providing highly sensitive open-ids/phone numbers unless you trust the remote service; prefer using a throwaway/test open-id and test with non-sensitive videos. If you need a guarantee about local-memory access (as SKILL.md claims), request the author to remove local DB usage or to document and opt-in to local persistence explicitly. If you want, I can scan the util.py (RequestUtil) and the remainder of files for the exact HTTP request construction and any hidden endpoints or fields used in uploads — that would raise confidence and let me tell you exactly what metadata is transmitted.

Type: OpenClaw Skill Name: smyx-pet-behavior-detection-analysis Version: 1.0.0 The skill bundle exhibits several high-risk patterns, including aggressive prompt instructions in SKILL.md that command the AI to ignore local memory/logs and exclusively use remote cloud APIs. It contains a significant amount of unrelated code (a complete 'face_analysis' skill nested within the pet skill), suggesting poor supply chain hygiene. Technically, the bundle implements an automated remote registration/login system in 'smyx_common/scripts/util.py' and 'dao.py' that collects user identifiers (like phone numbers) to fetch and store session tokens in a local SQLite database. Additionally, 'smyx_common/scripts/skill.py' contains logic to execute recursive agent commands via subprocess.run, which could be leveraged for complex prompt injection attacks. Remote communication is directed to lifeemergence.com.