天津安信华瑞

基于QuecPython平台的Modbus协议IoT框架，支持多传感器数据采集、4G通信、云端上报及OTA远程升级。

This package is a legitimate QuecPython Modbus IoT template but contains sensitive behaviours you should explicitly handle before deployment: 1) Change URL_REPORT and URL_OTA in config/config.py to your trusted endpoints — the template defaults point to the vendor and will receive IMEI/IMSI, cell info, and sensor data. 2) Review the OTA flow (data_reporter.run_ota) — it will download files and call firmware update and reboot; only allow OTA from trusted servers. 3) Backup your device and test in an isolated environment before deploying to production; copying files to /usr can overwrite modules. 4) If you do not want the device to send IMEI/IMSI, sanitize the reporting code (data_reporter) accordingly. 5) Perform network whitelisting or use a staging server to validate payload formats. If you want, provide the config/config.py defaults and I can highlight which fields to change and what values are safe.

Type: OpenClaw Skill Name: tianjin-anxinhuarui-gas-monitoring-iot Version: 1.0.0 The skill provides a functional framework for QuecPython-based IoT devices, specifically for gas monitoring, but includes several high-risk capabilities. It collects sensitive device identifiers (IMEI, IMSI, and ICCID) and implements an automated Over-The-Air (OTA) update mechanism in `data_reporter.py` that can trigger firmware re-flashing based on responses from hardcoded external endpoints (`iot.tranthing.com` and a Tencent Cloud instance). While these features are plausibly required for the stated purpose of managing remote hardware, the proactive OTA execution and the lack of explicit firmware signature verification in the provided source code represent a significant remote code execution (RCE) risk if the remote infrastructure is compromised.