智能喂食器宠物检测识别技能
ReviewAudited by ClawScan on May 10, 2026.
Overview
The pet-detection workflow is mostly coherent, but it needs review because it uses local/shared identity configuration or phone numbers for cloud reports and includes an unencrypted raw-IP API configuration.
Before installing, verify the active API base URL, remove or ignore the private-IP dev config, and confirm exactly which open-id will be used. Do not provide an API key, phone number, or private camera footage unless you trust the provider and understand how reports, pet enrollment data, and saved attachments can be deleted.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A shared or stale config value, API-key-like value, username, or phone number could be used to save or query pet reports under an account the user did not explicitly choose.
The skill tells the agent to use a local/shared config value named api-key, or collect a username/phone number, as the open-id for cloud report storage and history queries, while the registry metadata declares no required credentials or config paths.
如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id ... 检查 workspace 公共目录的配置文件 ... 提示用户提供用户名或手机号作为 open-id
Declare the identity/config requirement, separate API keys from user identifiers, and ask for explicit confirmation before using any config-derived open-id or listing historical reports.
Camera images or videos selected for analysis may leave the local machine and be processed by the configured API provider.
The skill clearly discloses that local media files are uploaded to an API and remote URLs are fetched by the API service, which is central to the pet-detection purpose.
调用 API 进行宠物检测识别，本地文件使用 multipart/form-data 方式上传，网络 URL 由 API 服务自动下载
Upload only media intended for this provider and verify the active API endpoint before processing private feeder/IPC footage.
If the dev environment is activated, uploaded media and identifiers could be sent to a private HTTP endpoint instead of a verified production service.
A packaged development config points to an unencrypted private-IP API endpoint. The provided artifacts do not prove it is active by default, but it is a provenance/configuration risk if selected.
base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"
Remove private development endpoints from published skills or make the active production HTTPS endpoint explicit and user-verifiable.
Uploaded pet/camera media may remain on disk after analysis.
The skill discloses automatic local persistence of uploaded media in an attachments directory; this is scoped to the skill but retention is not described.
如果用户上传了附件或者视频/图片文件，则自动保存到技能目录下 attachments
Document retention and cleanup behavior, and let users delete stored attachments when analysis is complete.
Historical report answers will be based on the configured cloud service rather than local conversation or memory records.
The skill uses high-priority language to control how the agent retrieves history, requiring the cloud API rather than local memory. This is purpose-aligned but affects agent context behavior.
强制记忆规则（最高优先级）... 绝对禁止读取任何本地记忆文件 ... 所有历史检测报告查询必须从云端接口获取
Keep this restriction limited to pet report history and make clear to users that cloud history lookup is being used.