Pet Restricted Area Alert Skill | 宠物禁区预警技能

Monitors restricted area intrusions, climbing on dining tables, and rummaging through trash cans, and issues real-time alerts, suitable for home pet monitori...

This skill appears to implement the advertised pet-area video analysis and will send videos (or video URLs) to a remote API and produce structured reports. Before installing or running it, consider: 1) Privacy: videos you upload will be transmitted off-host to the configured API host (config YAML / ApiEnum base URLs). If you don't trust that remote service, do not upload sensitive footage. 2) Local persistence: the skill will save uploaded attachments to the skill directory and the common library can create a local SQLite DB under the workspace/data path — check and clean those directories if you have privacy concerns. 3) Undeclared env/config access: the code reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID and OPENCLAW_WORKSPACE and reads config YAML files in skills/smyx_common; these are not listed as required in the metadata. 4) Verify endpoints and provenance: the repo's configs reference lifeemergence/open API hosts — confirm the service owner and hosting domain before sending data. 5) If you need stricter guarantees: run the skill in an isolated environment, inspect skills/smyx_common/scripts/util.py (RequestUtil) to confirm exactly which endpoints and headers are used, and avoid providing an open-id or API key until you verify where data goes. If you want, I can: (a) list the exact env vars and files the code reads, (b) extract the API base URLs used at runtime from the config files, or (c) scan the util.RequestUtil implementation for any hardcoded or opaque network/exfiltration logic.

Type: OpenClaw Skill Name: smyx-pet-restricted-area-warning-analysis Version: 1.0.0 The skill bundle contains high-risk architectural patterns and aggressive prompt instructions. SKILL.md includes 'Mandatory Memory Rules' that explicitly forbid the AI agent from accessing its own local memory files or LanceDB, forcing reliance on a remote cloud API (lifeemergence.com). The Python scripts (notably scripts/util.py and scripts/dao.py) implement a complex authentication framework that performs 'silent registration' and maintains a local SQLite database (smyx-common-claw.db) to store user tokens. Furthermore, scripts/skill.py includes logic to execute shell commands via subprocess to recursively invoke the 'openclaw' agent, which significantly expands the potential for unintended command execution.