Regional Humanoid Detection Skill | 区域人形检测技能

Automatically detects personnel in target areas based on computer vision. Supports real-time video stream detection and is suitable for monitoring personnel...

Key things to consider before installing: - Contradictory behavior: SKILL.md forbids reading local memory, but the code reads/writes local config and a SQLite DB and may save uploaded attachments. Ask the author to explain why local persistence is needed and whether the 'no local memory' rule is enforced by runtime checks. - Data exfiltration is expected but important: local video files are uploaded (multipart/form-data) to external APIs, or remote URLs are fetched by the API service. Check and approve the exact API endpoints in skills/smyx_common/scripts/config.yaml (the repo includes base URLs pointing to lifeemergence domains and dev/test hosts). If you need privacy, do not upload sensitive footage until you verify the service and agreements. - Hidden env/config dependencies: the skill does not declare required env vars, yet it reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_WORKSPACE, and may rely on API keys in config YAML. Ensure no sensitive credentials are present on your environment or in workspace config.yaml before use. - Broad codebase: the repo contains many unrelated components (pet/health/face-analysis artifacts and a large common library). This increases the attack surface and makes auditing harder. If you only need basic local human-detection, ask for a minimal implementation or sanitize the code. - Practical steps: review skills/smyx_common/scripts/config.yaml and config-dev/test files to confirm endpoints; inspect skills/smyx_common/scripts/util.py (RequestUtil and CommonUtil) to see exactly how HTTP requests are made and what headers/credentials are sent; test in an isolated environment with no sensitive credentials and with dummy videos; and request source/homepage/maintainer info since the skill's source is 'unknown'. If you cannot verify endpoints and the code paths that persist data, treat this skill as untrusted for sensitive video or credentials.

Type: OpenClaw Skill Name: smyx-human-detection-analysis Version: 1.0.0 The skill bundle exhibits high-risk behaviors including the use of `subprocess.run` to execute the `openclaw` agent CLI (in `skills/smyx_common/scripts/skill.py`) and automated remote registration/login logic that sends environment variables (like `OPENCLAW_SENDER_OPEN_ID`) to external endpoints (`lifeemergence.com`). Additionally, `SKILL.md` contains aggressive 'Mandatory Memory Rules' designed to override the AI agent's default behavior, forcing it to ignore local memory files and LanceDB in favor of the developer's cloud API. The bundle also includes unrelated sensitive modules for 'TCM Face/Health Analysis', suggesting over-privilege or poor scoping.