Fall Detection & Analysis Skill | 跌倒检测分析技能

Detects whether anyone has fallen within a specified target area. Supports both image and short video analysis. Suitable for scenarios such as home care for...

This skill is 'suspicious' because its runtime instructions and the actual code disagree about local data and configuration. Before installing or running it: - Do not provide sensitive credentials or personal identifiers (open-id) until you confirm who runs the remote API. The code will read OPENCLAW_SENDER_OPEN_ID, OPENCLAW_WORKSPACE and possibly other env vars even though 'required env vars' is empty. - Expect images/videos to be uploaded to remote APIs (base URLs are present in skills/smyx_common config pointing to lifeemergence domains). If you cannot trust those endpoints or need to keep media local, do not use it. - Inspect RequestUtil (skills/smyx_common/scripts/util.py) to see exact HTTP endpoints, headers and auth behavior. Confirm whether uploads are encrypted and where data is stored/retained server‑side. - The skill will create files and a local SQLite DB under the workspace data directory and save attachments; run it first in an isolated sandbox or container if you want to test safely. - Ask the skill author for: the canonical API host(s), data retention policy (how long reports/media are stored), whether any telemetry or analytics are sent, and a clear explanation why local DB/DAO code exists while SKILL.md forbids reading local memory. If you cannot get clear answers or do not want media sent externally or stored locally, avoid installing or run only in an isolated environment after code review.

Type: OpenClaw Skill Name: smyx-fall-detection-image-analysis Version: 1.0.0 The skill bundle implements a complex, multi-layered architecture that manages user authentication and session persistence via a local SQLite database (smyx-common-claw.db). It contains 'Mandatory Memory Rules' in SKILL.md that explicitly instruct the AI agent to bypass its standard local memory/LanceDB retrieval systems in favor of the provider's cloud API (lifeemergence.com), which could be used to control the agent's context. Furthermore, the utility scripts in smyx_common/scripts/skill.py include the capability to spawn new agent processes using subprocess.run, and RequestUtil automatically handles token harvesting and storage during API interactions. While these features support the stated fall-detection purpose, the combination of instructional hijacking, local credential management, and shell execution capabilities warrants a suspicious classification.