人体视觉情绪识别技能
SuspiciousAudited by ClawScan on May 10, 2026.
Overview
The skill is mostly aligned with face-based emotion analysis, but it handles sensitive facial and mental-health-style reports through cloud APIs with unclear authentication, identity, and retention boundaries.
Install only if you trust the configured cloud provider with face images/videos and emotion-analysis results. Before using history lookup, confirm how open-id is authenticated, do not use an API key as an open-id, and delete any saved attachments you do not want retained.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Sensitive historical emotion-recognition reports could be associated with or queried by weak identifiers, and a credential-like value could be reused or exposed as an identity value.
The skill treats a field named api-key as a user open-id and also allows username/phone-number open-id values while describing API authentication as optional. That is unclear for accessing and saving sensitive emotion reports.
“如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id” ... “提示用户提供用户名或手机号作为 open-id” ... “API 密钥可选...否则忽略鉴权”
Require a clearly scoped authenticated account or token for report access, keep open-id separate from API keys, and require explicit user confirmation before listing historical reports.
Your face images/videos and derived emotion analysis may leave the local environment and be processed by the configured provider.
The skill discloses that face images/videos are sent to an API service for analysis. This is purpose-aligned, but face media and emotion analysis are sensitive data flows.
“通过人脸视频/图片进行多维度情绪识别” ... “本地文件使用 multipart/form-data 方式上传，网络 URL 由 API 服务自动下载”
Use only media you have permission to analyze, avoid uploading highly sensitive footage unless you trust the provider, and review the provider’s retention and privacy terms.
Sensitive face videos or images may remain on disk after the task and could be exposed or reused unintentionally.
The skill instructs automatic local saving of uploaded face media, but the artifacts do not specify retention, cleanup, access limits, or whether these files may be reused later.
“如果用户上传了附件或者视频/图片文件，则自动保存到技能目录下 attachments”
Ask where attachments are stored, delete them after use if not needed, and prefer an explicit opt-in plus retention policy for storing biometric media.
If the dev environment is enabled, requests could go to an insecure private HTTP server rather than the intended production service.
A bundled development config points to a private raw-IP HTTP endpoint. It is not the default prod config, but it is an endpoint provenance risk if selected.
base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"
Keep production as the default, remove or clearly isolate dev configs, and avoid raw-IP HTTP endpoints in distributed skills.