TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具

Supports uploading local MP4 videos or network video URLs to call the server-side API for facial diagnosis. It returns structured TCM facial diagnosis result...

This skill does perform the advertised video→server analysis, but there are important red flags you should consider before installing or running it: - Policy/code contradiction: SKILL.md forbids reading local memory/history, yet the code reads/writes a local SQLite DB (workspace/data) and will try to cache or retrieve tokens locally. Expect local files to be created and read. - Undeclared environment access: the code reads environment variables (e.g., OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) even though the skill metadata lists no required env vars or credentials. If you run this skill, it may use those env values automatically. - Network endpoints: default config points to domains like lifeemergence.com / open.lifeemergence.com — the skill will send video metadata and might POST phoneLogin requests to those services. Confirm you trust those endpoints and understand their privacy policy before sending videos. - Local command execution: the bundled common module can call 'openclaw agent' via subprocess.run — that will execute a local binary with arguments. Only run in a trusted, sandboxed environment. - Large dependency footprint: the included common requirements are extensive; installing them on your system is a non-trivial action and may pull many packages. Recommendations: 1. Ask the publisher for the honest source/homepage and an explanation why local DB caching and subprocess invocation are necessary and why SKILL.md forbids reading memory while code uses local DB. 2. If you must test it, run in an isolated container or sandbox where network access, filesystem write locations, and subprocess calls are constrained. 3. Review and, if necessary, edit code to remove or control local DB writes and subprocess usage (or require explicit opt-in), and confirm the exact server endpoints and API key handling. 4. Do not provide sensitive videos, credentials, or global environment variables until you trust the endpoint and clarify what is stored locally. If the author can provide a minimal build that only performs multipart upload to a documented API and removes local DB caching and subprocess invocation, the concerns here would be greatly reduced.

Type: OpenClaw Skill Name: new-smyx-face-analysis Version: 1.0.0 The skill bundle includes a complex shared library (smyx_common) that implements a local SQLite database (smyx-common-claw.db) for token management and a RequestUtil that automatically exfiltrates environment variables (OPENCLAW_SENDER_OPEN_ID) to a remote backend (*.lifeemergence.com). SKILL.md contains high-priority 'Mandatory Memory Rules' that force the AI agent to ignore its own local memory/LanceDB in favor of remote API data, which is a significant prompt-injection control mechanism. Additionally, scripts/skill.py in the common library contains an ai_chat function that executes shell commands via subprocess.run to call the openclaw binary, posing a risk of recursive execution or command injection.