Plant Species Recognition Skill | 植物物种识别技能

Accurately identifies plant species from images based on deep learning and computer vision, outputs structured information including species name, family, gr...

What to check before installing or enabling this skill: - The package contains an unrelated face-analysis skill and a large shared library (skills/face_analysis and skills/smyx_common). If you only want plant recognition, ask the author why face/biometric code is bundled and whether a trimmed package exists. - Inspect RequestUtil (skills/smyx_common/scripts/util.py) and any http_post/http_get wrappers to see where images and metadata are sent (the repo contains prod base URLs like open.lifeemergence.com and other domains). If the skill uploads images or extracted data to external servers, confirm the destination, privacy policy, and whether you have permission to transmit those images. - The code reads/writes config.yaml files and will create a local SQLite database under the workspace/data directory. If you want to avoid local persistence, run the skill in a sandbox or deny write access and verify behavior. - SKILL.md forbids reading local 'memory' files, but the code can read environment variables (OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID) and configuration files to obtain open-id/api-key values. Ensure these environment/config sources do not contain sensitive secrets you don't want the skill to read. - Because the repo includes heavy dependencies, if you choose to run it, install and execute in an isolated environment (container, VM) with network egress controls, so you can observe outbound traffic before allowing access to production systems or sensitive data. Concrete actions: 1) Review skills/smyx_common/scripts/util.py (RequestUtil) and skills/smyx_common/scripts/config.yaml to see endpoints and whether API keys are used. 2) Search the code for any hard-coded URLs or domain names, and verify where reportImageUrl or exported reports are hosted. 3) If you still want to use it, request an author-provided, minimal plant-only package or a written privacy/data-flow statement describing what is uploaded, stored, and persisted. Confidence note: I gave 'suspicious' with medium confidence because important helper code (util.py) was not fully shown; reviewing RequestUtil and the actual network call implementations would raise or lower confidence.

Type: OpenClaw Skill Name: smyx-plant-species-recognition-analysis Version: 1.0.0 The skill provides plant species identification by interfacing with a remote API service (lifeemergence.com). It utilizes a shared library (smyx_common) that manages API authentication, local token storage via a SQLite database (smyx-common-claw.db), and structured reporting. While the SKILL.md contains 'Mandatory Memory Rules' that use high-priority instructions to restrict the agent's use of local memory in favor of cloud data, and the library includes capabilities for recursive agent calls via subprocess.run, these appear to be functional architectural choices for a cloud-synchronized service rather than evidence of malicious intent. The inclusion of unrelated 'face_analysis' files suggests a templated or reused codebase but does not present a direct security threat.