Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ezviz Open Restaurant Inspection

萤石餐饮行业智能巡检技能。通过设备抓图 + 智能体分析接口,实现对餐厅/厨房场景的 AI 巡检,包括地面卫生、动火离人、垃圾桶状态、货品存放和口罩佩戴等关键指标。

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 35 · 0 current installs · 0 all-time installs
byEzvizOpenTeam@Ezviz-Open
duplicate of @shuanhu95/hsa-test
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill name/description match the code and instructions: it uses Ezviz APIs to obtain a token, capture device images, and call an AI agent for analysis. Requesting EZVIZ_APP_KEY, EZVIZ_APP_SECRET and device serials is appropriate for this purpose. However, the top-level registry metadata claims 'Required env vars: none' while the SKILL.md and script clearly require Ezviz credentials—this metadata mismatch is an inconsistency to verify.
Instruction Scope
SKILL.md and the script limit runtime actions to obtaining a token, listing/creating intelligent agents, capturing images, and calling the AI analysis endpoint. Those actions are within the declared purpose. Important side-effect: the skill will automatically copy/create an intelligent agent from a template (templateId f4c255b2929e463d86e9) if no suitable agent exists; this modifies the user's Ezviz account and may consume quotas.
Install Mechanism
No install spec beyond installing the 'requests' Python package; the skill is instruction+script only. This is low-risk compared to arbitrary remote downloads or installers.
Credentials
The required credentials (app key, app secret, and device serial) are proportionate to the described functionality. The SKILL.md explicitly states token and agent ID are obtained/managed automatically. Still, verify you are comfortable providing appKey/appSecret (these are high-privilege credentials for your Ezviz account) and understand token lifetime and scope.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system-wide settings. Autonomous invocation (model invocation enabled) is default; combined with the account-modifying behavior (creating agents), this increases the blast radius if run without supervision — consider requiring user confirmation before running in production.
What to consider before installing
What to check before installing: 1) Confirm the registry metadata vs. SKILL.md discrepancy — the script requires EZVIZ_APP_KEY, EZVIZ_APP_SECRET, and EZVIZ_DEVICE_SERIAL even though the registry listed none. 2) Use a test/non-production Ezviz account first: the skill may automatically create an intelligent agent (from templateId f4c255b2929e463d86e9) and could consume your agent quota. 3) Only provide appKey/appSecret if you trust this skill and understand the token scope; rotate credentials after testing if needed. 4) Review network endpoints (open.ys7.com and aidialoggw.ys7.com) and your organizational policies for sending device images to that service. 5) If you want tighter control, modify the script to require explicit confirmation before creating agents or to run in read-only mode (skip template copy) and log/save tokens only if you accept that behavior.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk976pcrzyxm3ksj9ktbgk13de583133y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Ezviz Restaurant Inspection (萤石餐厅巡检)

通过萤石设备抓图 + 智能体分析接口,实现对餐厅场景的 AI 自动巡检。智能体自动管理:自动检测用户是否已有餐厅行业通用智能体,如无则自动复制模板创建。

快速开始

安装依赖

pip install requests

设置环境变量

export EZVIZ_APP_KEY="your_app_key"
export EZVIZ_APP_SECRET="your_app_secret"
export EZVIZ_DEVICE_SERIAL="dev1,dev2,dev3"

可选环境变量:

export EZVIZ_CHANNEL_NO="1"

注意:

  • 不需要设置 EZVIZ_ACCESS_TOKEN!技能会自动获取 Token
  • 不需要设置 EZVIZ_AGENT_ID!技能会自动管理智能体
  • 设备需要支持抓拍功能

运行

python3 {baseDir}/scripts/restaurant_inspection.py

命令行参数:

python3 {baseDir}/scripts/restaurant_inspection.py appKey appSecret dev1 [channel_no]
python3 {baseDir}/scripts/restaurant_inspection.py appKey appSecret "dev1,dev2,dev3" [channel_no]

工作流程

  1. 获取 Token (appKey + appSecret -> accessToken)
  2. 查询智能体列表 (检查是否已有餐厅通用智能体) 3a. 如果存在:直接使用现有智能体的 appId 3b. 如果不存在:复制模板 (templateId=f4c255b2929e463d86e9) 创建新智能体
  3. 设备抓图 (accessToken + deviceSerial -> picUrl)
  4. AI 分析 (appId + picUrl -> 分析结果)
  5. 输出结果 (JSON + 控制台)

智能体自动管理说明

智能体检测与创建流程:

每次运行:

  1. 查询用户智能体列表 (appType=1)
  2. 检查是否存在名称包含"餐厅"或"餐饮"的智能体 3a. 如果存在 -> 使用第一个匹配的智能体 appId 3b. 如果不存在 -> 调用复制接口创建新智能体
    • templateId: f4c255b2929e463d86e9 (餐厅行业通用模板)
    • 返回新智能体的 appId

智能体管理特性:

  • 自动检测:自动查找现有餐厅智能体
  • 防重复创建:避免为同一用户重复创建相同智能体
  • 模板复制:自动从标准模板创建专用智能体
  • 无缝集成:用户无需手动管理智能体

网络端点

域名用途
open.ys7.comToken、抓图 API
aidialoggw.ys7.com智能体分析 API

输出示例

======================================================================
Ezviz Restaurant Inspection Skill (萤石餐厅巡检)
======================================================================
[Time] 2026-03-16 22:35:00
[INFO] Target devices: 2
 - dev1 (Channel: 1)
 - dev2 (Channel: 1)

======================================================================
[Step 1] Getting access token...
[SUCCESS] Token obtained, expires: 2026-03-23 22:35:00

======================================================================
[Step 2] Managing intelligent agent...
[INFO] Found existing restaurant agent: appId_12345
[SUCCESS] Using existing agent: appId_12345

======================================================================
[Step 3] Capturing and analyzing images...
======================================================================

[Device] dev1 (Channel: 1)
[SUCCESS] Image captured: https://opencapture.ys7.com/...
[SUCCESS] Analysis completed!

[Analysis Result]
{
  "食品安全": "合格",
  "卫生状况": "良好",
  "人员着装": "规范",
  "违规行为": "未发现"
}

======================================================================
INSPECTION SUMMARY
======================================================================
 Total devices: 2
 Success: 2
 Failed: 0
 Agent ID: appId_12345
======================================================================

API 接口

接口URL文档
获取 TokenPOST /api/lapp/token/gethttps://open.ys7.com/help/81
设备抓图POST /api/lapp/device/capturehttps://open.ys7.com/help/687
智能体列表GET /api/service/open/intelligent/agent/app/list内部接口
智能体复制POST /api/service/open/intelligent/agent/template/copy内部接口
AI 分析POST /api/service/open/intelligent/agent/engine/agent/anaylsishttps://open.ys7.com/help/5006

注意事项

频率限制: 萤石抓图接口建议间隔 4 秒以上,频繁调用可能触发限流 (错误码 10028)

智能体配额: 每个用户可能有智能体创建数量限制,请确保配额充足

Token 安全: Token 仅在内存中使用,不写入日志,不保存到磁盘

分析超时: AI 分析可能耗时较长,默认超时 60 秒

模板 ID 固定: 餐厅行业通用模板 ID 固定为 f4c255b2929e463d86e9

应用场景

场景说明
食品安全巡检自动检测食品存储、加工过程合规性
卫生状况监控识别清洁状态、垃圾处理、消毒情况
员工规范检查检查工作服、口罩、手套佩戴情况
合规性审计自动生成巡检报告,满足监管要求
连锁店管理多门店统一标准,远程集中监控

安全声明

本技能会对用户的萤石账号执行以下操作:

  • 读取智能体列表
  • 可能创建新的智能体 (从官方模板复制)
  • 读取设备抓拍图片
  • 调用 AI 分析服务

所有操作均通过萤石官方 API 执行,Token 仅在内存中使用。

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…