Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because scanners report a mismatch with its pet respiratory-monitoring purpose, broad media submission, and unexpected account and credential handling; they do not establish malicious intent.
Consider not installing until the publisher explains the remote media processing, identity registration, and credential storage, and clarifies why these are needed for pet monitoring. The scan was partial: it inspected all listed components but could not resolve a local reference, and some imported behavior could not be assessed, so the evidence is incomplete.
The supplied chunk does not implement the declared monitoring behavior; it primarily contains generic scaffolding and a nonfunctional chat helper. It does not actually execute the commented-out external command. Imported base classes and API services are not supplied, so their behavior cannot be assessed; the mismatch conclusion is limited to the visible code.
Database persistence could support the declared event-recording feature, so generic CRUD alone is not a mismatch. However, this chunk specifically defines and manages sys_user records containing personal information and tokens rather than pet respiratory events. That is a materially different capability not explained by the description. No camera capture, audio analysis, sneeze/cough detection, or event-frequency logic appears in this chunk. This assessment is limited to the supplied code; it does not establish whether other files implement the declared detection functionality.
The supplied chunk contains no camera capture, audio analysis, sneeze/cough classification, or respiratory-event tracking. That absence alone would not establish a mismatch because this is a shared utility module. However, its conditional identity provisioning, remote registration, credential persistence, and authenticated-service integration introduce substantive account and network behavior absent from the declared purpose. Ordinary JSON, date, polling, and filesystem helpers are supporting implementation details and are not independently flagged. The assessment is limited to the supplied code; it does not establish what other skill files implement.
The visible implementation does not substantiate the specialized real-time monitoring described. It forwards an input reference to an imported analysis component and returns its output; no camera-stream handling, respiratory-event detection, burst thresholds, or event counting is visible. The imported component could implement some specialized analysis, so its absence here is an evidentiary limitation rather than proof that those features do not exist elsewhere. History retrieval and optional output-file writing are supporting functionality, not independently suspicious behavior.
The visible implementation is a video-analysis submission and report-retrieval wrapper, materially narrower than the advertised real-time respiratory-event monitoring capability. Imported API methods could provide pet-specific analysis, but their implementations are not supplied, so that functionality cannot be verified. File validation, API submission, polling, and report formatting are supporting implementation details and are not independently treated as suspicious or unrelated behavior.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-sneeze-cough-detection-analysis"
description: "AI-powered pet sneeze/cough detection from real-time camera (optional audio fusion). Analyzes head and thoracic-abdominal motion plus sound features to distinguish single occasional events (normal airway clearing) from continuous bursts (e.g. ≥3 sneezes/min, frequent dry/wet coughing) and records event time and frequency. Helps catch respiratory infection, allergy, or foreign-body irritation early. Scenarios: home health monitoring, animal hospital wards, pet boarding centers. | 通过宠物摄像头实时分析宠物头部和胸腹部的动作，结合可选的声音分析，�
Without declared permissions the skill's intent is opaque and cannot be validated.
The default trigger covers any pet-activity video analysis, even when the user has not requested respiratory detection. Because this workflow submits media to a cloud API, overbroad activation can send private footage for processing outside the user's intended task.
Although the document mentions APIs, it does not clearly explain that local camera footage or supplied media URLs leave the user's environment for third-party processing. Home and hospital footage can contain people, conversations, or sensitive surroundings, making undisclosed transfer a meaningful privacy risk.
The parser accepts --export-env-only, but the execution path never checks it and still initializes identity and performs analysis when media is supplied. A caller relying on the explicit no-analysis promise can unintentionally upload private footage or trigger remote processing.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The code reads the complete local video and passes its bytes into the analysis API request without an upload notice or authorization gate in this path. Camera recordings can expose household members, audio, or clinical surroundings beyond the pet behavior the user wants analyzed.
The --export-env-only flag is parsed but never used to stop execution, so media inputs still reach analyze_video. This breaks an explicit no-analysis boundary and can cause unintended media submission and remote account activity.
The User model stores personal information and authentication tokens, and UserDao exposes inherited read, write, update, and delete operations for those records (L448–L473). This is more than passive shared-library scaffolding: Dao initialization creates registered tables and unconditionally migrates sys_user (L184–L214). The manifest describes respiratory-event detection and event recording, not user-account or credential management.
The docstring at L26 explicitly says this method invokes the openclaw agent through subprocess. However, the invocation at L61–L66 is commented out and replaced with an empty dictionary at L68; accessing result.stderr then raises an exception that is caught at L81–L82, so the method returns no analysis result.
The generic open helper uses mode 'w', which immediately erases an existing file's contents. No docstring, comment, confirmation, or user-facing message explains this destructive behavior; the exception handler only runs if opening fails.
An ordinary HTTP operation can automatically perform remote registration using the current identity and persist returned authentication tokens in the local user database. This crosses account-creation and credential-persistence boundaries without an explicit opt-in in the shown flow, which is unexpected from the stated pet-monitoring purpose.
The registration helper explicitly sets silent and register flags and sends the current identity as both openId and mobile. Invoking it implicitly during HTTP requests can disclose an existing identity and create a remote account without a separate enrollment decision; this overlaps the registration issue above.
The POST transmits the selected identity and skill-hub source to a configured remote login service as part of implicit registration. Network transmission alone is not a vulnerability, but this specific transmission lacks an explicit consent gate and can use an identity selected from API_SECRET_KEY; the destination's trustworthiness is not established by the supplied source.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
At L017–L020, YamlUtil.load creates parent directories and writes a YAML file if the requested configuration is missing, without a comment, docstring, or user-facing disclosure explaining this side effect. BaseEnum.init_subclass calls this loader at L053 and L058, so importing the module can modify the filesystem without an explicit save request.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()