ℹ
Purpose & Capability
The name/description (smoking detection via CV) matches the included code (scripts/smoking_detection_analysis.py and related API client code). Declared dependency on smyx_common is reasonable because shared APIs/config/utilities are used. However, the package bundle also contains a large 'face_analysis' subskill and a broad 'smyx_common' library (DB/DAO/config) that are not strictly necessary for a focused smoking-detection helper; their presence increases complexity and persistence surface.
⚠
Instruction Scope
SKILL.md mandates obtaining an open-id by reading config files in skills/smyx_common/scripts/config.yaml (and workspace-level config), requires saving uploaded attachments to a local attachments directory, and forbids reading local 'memory' files or LanceDB. The code does read config.yaml, sets ConstantEnum.CURRENT__OPEN_ID from passed args or environment, and will read and write files (including creating a local SQLite DB under workspace/data via the DAO utilities). The instructions force uploading media to a remote API (via RequestUtil/http_post), meaning user media is transmitted off-host. The prohibition on local memory access contrasts with the skill's use of other local config files and local DB utilities—this is inconsistent and should be clarified.
ℹ
Install Mechanism
No install spec is provided (instruction-only), which is low-risk for automatic code fetching; however the repository contains many Python modules and a large requirements list in smyx_common/requirements.txt. Running the skill will require installing many dependencies (including network and DB libs). The lack of an install step means a user or operator will need to review and install dependencies manually in their environment—this elevates operational risk if done without inspection or sandboxing.
⚠
Credentials
The registry metadata shows no required env vars, but the code reads several environment variables implicitly: OPENCLAW_SENDER_OPEN_ID / OPENCLAW_SENDER_USERNAME / FEISHU_OPEN_ID (via ConstantEnum.init), and OPENCLAW_WORKSPACE is used to determine where DB/files are stored. The skill also expects/prohibits particular open-id values and requires an open-id to operate. The implicit use of workspace and sender env vars is not declared in the skill metadata, which is a proportionality / transparency problem. The skill will send uploaded media and request parameters to external API endpoints (configured in smyx_common config.yaml), so API keys, personal identifiers (open-id/username/phone), and media may be transmitted off-host.
⚠
Persistence & Privilege
The skill will create/use local persistence: it uses dao.py to initialize or access a SQLite DB under a data directory (derived from OPENCLAW_WORKSPACE or workspace path) and will save uploaded attachments to a skill attachments folder. The SKILL.md explicitly instructs saving attachments locally. The skill does not request 'always: true' and does not try to modify other skills' configurations, but it does read other-skill config files (skills/smyx_common/scripts/config.yaml) and can create local files and DBs—this is a non-negligible level of persistence and should be expected and consented to by the operator.
ℹ
scan_findings_in_context