Pet Breed & Individual Identification Skill | 宠物品种个体识别技能

Accurately identifies cat and dog breeds and supports distinguishing between different individuals in multi-pet households; an essential assistant for intell...

What to check before installing/running: 1) Data exfiltration & privacy: this skill uploads user images/videos to remote AI endpoints (the config files point to lifeemergence domains). If you will send sensitive images, confirm the remote service's privacy policies and legal jurisdiction. 2) Open‑ID & credentials: SKILL.md mandates a strict open-id retrieval flow from specific config files or user input, but the code will accept environment variables (OPENCLAW_SENDER_OPEN_ID) and will read config under skills/smyx_common/scripts/config.yaml. Decide where open-id/API keys should come from and avoid setting them globally in env if you don’t want them reused automatically. 3) Local persistence: the skill writes attachments and creates an SQLite DB under the workspace/data path. If you do not want local copies of uploads or histories, review and remove/modify the DAO/FileUtil behaviors before running. 4) Unexpected bundled code: the package includes a broad common library and a separate face_analysis skill. Review skills/smyx_common/scripts/util.py and api_service.RequestUtil to confirm exactly how HTTP requests are made (endpoints, headers, timeouts, whether tokens are exfiltrated), and ensure there are no hidden endpoints or unexpected data sinks. 5) Dependencies and runtime: there is no install spec; if you run the provided scripts they expect Python packages. The SKILL.md lists only 'requests' but the repository contains large requirements files — avoid mass-installing unreviewed dependencies. Prefer running in an isolated environment (container/VM) and inspect network traffic during a test run. 6) Conflicting rules: SKILL.md forbids reading local memory and LanceDB, but code may still access workspace config and DB files; if that contradiction is unacceptable, request the author to clarify or remove unintended local I/O. If you want to proceed safely: run the skill in an isolated environment, audit util.RequestUtil and config files to verify target endpoints and headers, and avoid setting global environment credentials until you confirm the service behavior. If you cannot validate these items, treat the skill as untrusted and do not run it with sensitive data.

Type: OpenClaw Skill Name: smyx-pet-breed-individual-recognition-analysis Version: 1.0.0 The skill bundle contains aggressive prompt injection instructions in SKILL.md that mandate the AI agent bypass its own local memory and LanceDB to force reliance on a third-party API. The underlying framework in smyx_common/scripts/util.py implements a 'silent' registration and phone-login flow that exfiltrates user-provided identifiers (usernames or phone numbers) to remote endpoints (lifeemergence.com). Furthermore, the bundle includes a local SQLite database (smyx-common-claw.db) for credential persistence and utilizes subprocess.run in smyx_common/scripts/skill.py to perform recursive agent executions, which significantly expands the attack surface.