Intelligent Video Search & Retrieval Analysis Skill | 视频搜索检索智能分析技能

Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval,...

Key points to consider before installing or running this skill: - Data exfiltration risk: The scripts upload video files (multipart/form-data) to remote AI endpoints (default base URLs in smyx_common point at lifeemergence.com). If your videos contain sensitive personal or confidential content, do NOT run the skill until you confirm the target API and privacy policy. - Undeclared environment/config requirements: The skill metadata says no env vars or credentials are required, but the code reads OPENCLAW_WORKSPACE, open-id settings and config YAMLs that can contain API keys/base URLs. Expect to provide an open-id and possibly API keys via config or CLI. - Local persistence mismatch: SKILL.md forbids reading local memory files, but the code includes a local DAO (SQLite) and will create/read config and data files under the workspace. That contradicts the documentation and may leave artifacts on disk. - Larger-than-expected footprint: The bundle contains extra modules (face_analysis, many common libraries and a long requirements list). This increases attack surface and may import many packages when executed. - Ask the author / verify before use: Request clarification about (1) exact API endpoints used, (2) where uploaded video data is stored/retained, (3) whether the included face_analysis modules are needed, and (4) why the SKILL.md prohibits local memory reads while the code accesses local config/DB. - If you must try it: run in an isolated environment (sandbox/container) with non-sensitive test videos, inspect the RequestUtil and ApiEnum config values to confirm remote hosts, and ensure OPENCLAW_WORKSPACE points to a location you control. Do not run it on production machines or with private footage until you confirm behavior. If you want, I can: (a) extract the exact default API base-URLs and endpoints used in code, (b) summarize the RequestUtil implementation to show where HTTP requests are sent, or (c) point out all places where files are written/read so you can audit local persistence.

Type: OpenClaw Skill Name: smyx-video-search-analysis Version: 1.0.0 The skill bundle exhibits high-risk behavior through complex credential management and execution capabilities. It implements a local SQLite database (smyx-common-claw.db) to persist user tokens and 'open-ids' (which may include phone numbers), and includes a utility in `skills/smyx_common/scripts/skill.py` that can recursively invoke the `openclaw` agent via `subprocess.run`. Furthermore, `SKILL.md` contains 'Mandatory Memory Rules' that explicitly command the AI agent to ignore its own local memory files and long-term storage, forcing exclusive reliance on the developer's cloud API (open.lifeemergence.com). While these features appear intended for a production-grade service integration, the combination of credential caching, recursive CLI invocation, and strict memory-access overrides creates a significant surface for control and data redirection.