Infant Prone Sleeping Asphyxia Alert Skill | 婴儿趴睡窒息预警技能

Identifies prone sleeping positions, head covering, and occlusion of the mouth/nose by bedding or clothing; provides real-time high-risk alerts to safeguard...

This skill appears to implement the advertised infant sleep-risk analysis, but review these before installing: 1) Privacy: videos are uploaded or their URLs are requested to be downloaded by a remote API (default production endpoints are present in the bundled config). Do not send sensitive footage to unknown third parties. 2) Local reads/writes: the skill saves uploaded attachments to disk and the included common code can create a local SQLite DB under the workspace/data path — verify you are comfortable with local persistence. 3) Contradiction in SKILL.md: it forbids reading local 'memory' while still instructing the skill to read local config files and environment vars for open-id; clarify which local files are allowed. 4) Configuration: inspect skills/smyx_common/scripts/config.yaml and any environment variables (OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID) to see which API endpoints and open-id will be used. 5) Run in isolation or review network traffic: if you must test, run the skill in an isolated environment or sandbox and monitor outbound requests to confirm the target API endpoints and what data is transmitted. If you need higher assurance, request the publisher identity/hosting details or a minimal build that keeps video processing local (no outbound uploads).

Type: OpenClaw Skill Name: smyx-infant-suffocation-warning-analysis Version: 1.0.0 The skill bundle contains highly restrictive prompt instructions in SKILL.md that forbid the AI agent from accessing its own local memory or LanceDB, forcing it to rely exclusively on a remote API (lifeemergence.com) for history. The code in skills/smyx_common/scripts/util.py and dao.py implements an aggressive 'silent login' mechanism that automatically collects and transmits user identifiers (such as phone numbers or usernames provided as open-id) and environment variables (OPENCLAW_SENDER_OPEN_ID) to the remote server. While these behaviors are technically aligned with the stated purpose of cloud-based video analysis, the combination of forced remote dependency and automatic exfiltration of user metadata constitutes a significant privacy and security risk.