xiaomi-cam-snapshot

SUSPICIOUS. 该技能的用途与“摄像头截图”基本一致，但实际执行依赖一个非官方可验证路径的 dev 容器，并以 host 网络运行，还接收用户密码与摄像头数据。主要风险是供应链与凭据/数据流进入未充分验证的容器，而不是明确恶意行为。

The code appears intended as a camera image downloader, not malware. It has significant transport-security weaknesses because authentication and image requests use HTTP, and user-controlled filenames can escape the selected output directory. Optional cleanup can delete old images in its target directory. The undefined `epilog` name also prevents normal execution as supplied.