Bird Recognition Tool | 鸟类识别工具

This skill is not an outright exploit, but several mismatches increase risk. Before installing or enabling it: - Verify the API endpoints: the bundled config defaults point to lifeemergence.com; if you don't trust that service, do not pass API keys or open-ids. - Do not provide sensitive credentials or production open-ids without reviewing where they are stored (skills/smyx_common/scripts/config.yaml and workspace-level config files). The skill expects an 'open-id' and will try to read workspace config files and environment variables. - Expect local persistence: the skill includes code that writes a SQLite DB to the workspace/data directory and may save attachments. If you need isolation, run it in a sandboxed workspace. - Review included files (smyx_common and face_analysis) — they expand the attack surface and are not strictly required for a minimal bird-recognition wrapper. If you only want image-to-API behavior, consider a slimmer alternative or extract/inspect the specific API-calling logic. - If you proceed, monitor network traffic and filesystem writes (where report export URLs point, what files are created), and avoid supplying secrets until you confirm where they are sent. If you want, I can: list the exact places the code reads/writes files and which environment variables it consults, or point out the exact lines that construct external URLs and local DB paths.