Virtual Fence Crossing Alert Skill | 虚拟围栏越界预警技能

Customizes safety zones, identifies babies crawling out or approaching dangerous areas such as bedsides/windowsills, and immediately alerts to protect baby s...

What to consider before installing or running this skill: - Network/privacy: The skill uploads user video (local file or URL) to remote API endpoints configured in smyx_common; verify and trust the API host (config points to lifeemergence/open API hosts) before sending sensitive video of your home/child. - Config and env access: The SKILL.md requires reading open-id from config files under skills/smyx_common or the workspace; this can read settings outside the skill directory. If you keep secrets or credentials in workspace config files, review them first. - Undeclared env usage: The code reads environment variables (e.g., OPENCLAW_SENDER_OPEN_ID, OPENCLAW_WORKSPACE) even though the skill declares no required env vars; consider explicitly setting/inspecting these to avoid unintended behavior. - Persistent local data: Running the skill may create/modify files (attachments folder, a SQLite DB under workspace/data). If you want to avoid persistent traces, run in a controlled environment or inspect/clean the workspace after use. - Large shared library: The package includes a big 'smyx_common' library and an unrelated face_analysis skill; review skills/smyx_common/scripts/util.py and RequestUtil to understand exactly what HTTP endpoints and headers are used and whether any credentials are transmitted. - If you need higher assurance: ask the skill author for the exact API base URL(s), what data fields are sent, and a concise list of environment variables read; or run the code in an isolated sandbox and/or review RequestUtil implementation to confirm no unexpected exfiltration. Given the mismatches (workspace config access, undeclared envs, persistent DB usage) I recommend caution — treat this as untrusted until you verify the remote endpoints and configuration files it will read.

Type: OpenClaw Skill Name: smyx-virtual-fence-intrusion-warning-analysis Version: 1.0.0 The skill bundle exhibits high-risk capabilities and aggressive prompt control instructions. SKILL.md contains 'Mandatory Memory Rules' that use high-priority directives to force the AI agent to ignore local memory (LanceDB/local files) and exclusively use a remote cloud API (lifeemergence.com), which overrides standard agent behavior. The common utility library (skills/smyx_common/scripts/skill.py) includes an AgentSkill class that uses subprocess.run to execute 'openclaw agent' commands, enabling recursive agent execution. Additionally, RequestUtil (skills/smyx_common/scripts/util.py) automatically transmits user identifiers to a remote login endpoint. While these features appear designed to support a cloud-synchronized safety monitoring service, the combination of shell execution and strict prompt-based control of data flow warrants a suspicious classification.