Parkinson's & Epileptic Behavior Recognition Skill | 帕金森癫痫行为识别技能

Identifies abnormal behaviors such as limb tremors, convulsions, stiffness, and gait abnormalities through video recognition, assisting in home risk monitori...

Security Scan

The skill appears to implement cloud-based video analysis consistent with its stated purpose, but there are several inconsistencies and safety-relevant choices (undeclared environment access, local persistence, enforced cloud-only workflows, and broad bundled libraries) that warrant review before installation.

Purpose & Capability

The code implements video upload and cloud API calls for behavior recognition, which matches the described purpose. However the package also includes a sizable common library (skills/smyx_common) that manages local SQLite storage, reads environment variables (OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID) and constructs export/report URLs pointing to external domains (lifeemergence.com). The skill declares no required env vars or credentials, yet expects an open-id and (optionally) an API key and will consult local config files; that mismatch between declared requirements and actual behavior is inconsistent.

Instruction Scope

SKILL.md forces specific runtime behavior: saving uploaded attachments into the skill directory, requiring a cloud 'open-id' lookup sequence (including reading skills/smyx_common/scripts/config.yaml and workspace config), and mandating cloud queries for historical reports while forbidding reading local memory. The runtime scripts will read files, write results, create/use a local SQLite DB, and send video files or URLs to remote APIs. These instructions direct potentially sensitive user video data to external endpoints and also persist data locally — both are within the code but not explicitly declared to users as privacy/IO implications in advance.

Install Mechanism

No install spec is provided (the skill is instruction/code-only), so nothing will be automatically downloaded on install. However the repo includes a large requirements.txt under skills/smyx_common listing many dependencies (network, crypto, DB, OpenAI, etc.) which is disproportionate to a small video-upload wrapper and could expand attack surface if installed. Because there is no automatic installer, the risk is primarily from running the included scripts rather than an automated install process.

Credentials

The skill declares no required environment variables or primary credential but the code reads environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID, OPENCLAW_WORKSPACE) and will consult config files under skills/smyx_common for API keys and base URLs. It also allows passing --api-key on the CLI. That the SKILL.md does not list these environment accesses (or explain where data goes) is an inconsistency. Uploading videos and query history may transmit personal/medical data to remote servers — access to credentials or workspace paths is therefore sensitive and currently under-specified.

Persistence & Privilege

The skill will persist data locally: it writes uploaded attachments into an attachments directory and smyx_common.dao creates an SQLite DB under a workspace data directory (derived from OPENCLAW_WORKSPACE or parent dirs). 'always' is false and it does not auto-enable itself, but it does create persistent artifacts and local records which increase persistence and data-at-rest concerns. It does not modify other skills' configs, but it reads/writes files in the workspace.

Scan Findings in Context

[no_injection_signals] expected: Pre-scan reported no injection signals. The code still contains expected network activity (HTTP POSTs to analysis endpoints) and file I/O for uploading videos and persisting results, which are consistent with a video-analysis skill.

What to consider before installing

Before installing or running this skill, consider the following: (1) Source provenance — the package has no homepage and an unknown owner; verify the author or run in an isolated/test environment. (2) Data flows — the skill uploads videos (potentially sensitive medical/home videos) to external APIs (config points to lifeemergence domains); review and confirm the destination, privacy policy, and whether an API key is required. (3) Undeclared env/config usage — the code reads OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, FEISHU_OPEN_ID and local config files; ensure these values are safe to expose and inspect skills/smyx_common/scripts/config.yaml and prod/test configs before use. (4) Local persistence — uploads/attachments and a SQLite DB are written into workspace data; if that is undesired, run in a sandbox or modify the code. (5) Dependency surface — a large requirements file is present; installing dependencies may bring in many packages. (6) Test with non-sensitive dummy videos and confirm where data is transmitted and stored; request the vendor/source to provide explicit API endpoint and data-retention details. If you cannot validate these points, avoid using with real patient data.

Based on advanced computer vision technology, this feature conducts 24/7 intelligent scanning of designated surveillance areas such as community stations, residential entrances, and office building lobbies. The system precisely identifies express packages within the zone, automatically determining the presence and status of parcels. Perfectly suited for express inventory checks and unattended notification scenarios, it triggers alerts immediately upon detecting new arrivals or abnormal, effectively solving the problems of low efficiency and missed items in traditional manual inspections, and significantly improving the management efficiency and security of last-mile logistics.

本功能搭载先进的视频分析算法，能够对帕金森病等慢性病患者的日常活动进行非接触式智能监测。系统通过捕捉并分析肢体震颤、抽搐、肌肉僵硬及步态异常等典型运动特征，自动识别病情波动或潜在风险。这一技术将专业的临床观察延伸至家庭场景，帮助医生远程掌握患者症状变化，为调整治疗方案提供客观依据，实现从被动就医到主动健康管理的模式转变

⚠️ 强制记忆规则（最高优先级）

本技能明确约定：

• 绝对禁止读取任何本地记忆文件：包括但不限于 memory/YYYY-MM-DD.md、MEMORY.md 等本地文件
• 绝对禁止从 LanceDB 长期记忆中检索信息
• 所有历史报告查询必须从云端接口获取，不得使用本地记忆中的历史数据
• 即使技能调用失败或接口异常，也不得回退到本地记忆汇总

任务目标

• 本 Skill 用于：通过居家监控视频识别帕金森、癫痫患者的异常行为发作
• 能力包含：肢体震颤识别、抽搐识别、肌肉僵硬检测、步态异常识别、异常发作统计
• 支持识别：
  • 帕金森：静止性震颤、肌肉僵硬、步态姿势障碍
  • 癫痫：突发抽搐、痉挛发作
• 适用场景：慢性病患者居家日常监测、异常发作记录辅助医生诊断
• 触发条件:
  1. 默认触发：当用户提供监控视频需要识别异常行为时，默认触发本技能
  2. 当用户明确需要帕金森监测、癫痫识别时，提及震颤识别、抽搐检测、帕金森监测、癫痫识别等关键词，并且上传了视频/图片
  3. 当用户提及以下关键词时，自动触发历史报告查询功能 ：查看历史识别报告、行为识别报告清单、识别报告列表、查询历史识别报告、显示所有识别报告、行为识别分析报告，查询帕金森癫痫行为识别分析报告
• 自动行为：
  1. 如果用户上传了附件或者视频/图片文件，则自动保存到技能目录下 attachments
  2. ⚠️ 强制数据获取规则（次高优先级）：如果用户触发任何历史报告查询关键词（如"查看所有识别报告"、"显示所有监测记录"、" 查看历史报告"等），必须：
     • 直接使用 python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --list --open-id 参数调用 API 查询云端的历史报告数据
     • 严格禁止：从本地 memory 目录读取历史会话信息、严格禁止手动汇总本地记录中的报告、严格禁止从长期记忆中提取报告
     • 必须统一从云端接口获取最新完整数据，然后以 Markdown 表格格式输出结果

前置准备

• 依赖说明:scripts 脚本所需的依赖包及版本

  requests>=2.28.0
  

监测要求（获得准确结果的前提）

为了获得准确的行为识别，请确保：

1. 摄像头固定位置，覆盖患者日常活动区域
2. 光线充足，避免过度曝光和大面积阴影
3. 患者全身/半身能够出现在画面中，便于观察步态和肢体动作

操作步骤

🔒 open-id 获取流程控制（强制执行，防止遗漏）

在执行帕金森癫痫行为识别分析前，必须按以下优先级顺序获取 open-id：

第 1 步：【最高优先级】检查技能所在目录的配置文件（优先）
        路径：skills/smyx_common/scripts/config.yaml（相对于技能根目录）
        完整路径示例：${OPENCLAW_WORKSPACE}/skills/{当前技能目录}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id
        ↓ (未找到/未配置/api-key 为空)
第 2 步：检查 workspace 公共目录的配置文件
        路径：${OPENCLAW_WORKSPACE}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id
        ↓ (未找到/未配置)
第 3 步：检查用户是否在消息中明确提供了 open-id
        ↓ (未提供)
第 4 步：❗ 必须暂停执行，明确提示用户提供用户名或手机号作为 open-id

⚠️ 关键约束：

• 禁止自行假设,自行推导,自行生成 open-id 值（如 openclaw-control-ui、default、parkinson123、epilepsy456 等）
• 禁止跳过 open-id 验证直接调用 API
• 必须在获取到有效 open-id 后才能继续执行分析
• 如果用户拒绝提供 open-id，说明用途（用于保存和查询识别报告记录），并询问是否继续

---

• 标准流程:
  1. 准备视频输入
     • 提供本地视频文件路径或网络视频 URL
     • 覆盖患者日常活动区域，便于观察肢体行为
  2. 获取 open-id（强制执行）
     • 按上述流程控制获取 open-id
     • 如无法获取，必须提示用户提供用户名或手机号
  3. 执行帕金森癫痫行为识别分析
     • 调用 -m scripts.parkinson_epilepsy_behavior_recognition_analysis 处理视频（必须在技能根目录下运行脚本）
     • 参数说明:
       • --input: 本地视频/图片文件路径（使用 multipart/form-data 方式上传）
       • --url: 网络视频/图片 URL 地址（API 服务自动下载）
       • --open-id: 当前用户的 open-id（必填，按上述流程获取）
       • --list: 显示历史帕金森癫痫行为识别分析报告列表清单（可以输入起始日期参数过滤数据范围）
       • --api-key: API 访问密钥（可选）
       • --api-url: API 服务地址（可选，使用默认值）
       • --detail: 输出详细程度（basic/standard/json，默认 json）
       • --output: 结果输出文件路径（可选）
  4. 查看分析结果
     • 接收结构化的帕金森癫痫行为识别分析报告
     • 包含：视频基本信息、识别到的异常行为类型、发作次数、发作时长统计、整体风险评估、就医建议

资源索引

必要脚本：见 scripts/parkinson_epilepsy_behavior_recognition_analysis.py( 用途：调用 API 进行帕金森癫痫行为识别分析，本地文件使用 multipart/form-data 方式上传，网络 URL 由 API 服务自动下载)

• 配置文件：见 scripts/config.py(用途：配置 API 地址、默认参数和格式限制)
• 领域参考：见 references/api_doc.md(何时读取：需要了解 API 接口详细规范和错误码时)

注意事项

• 仅在需要时读取参考文档，保持上下文简洁
• 支持格式：jpg/jpeg/png/mp4/avi/mov，最大 100MB
• API 密钥可选，如果通过参数传入则必须确保调用鉴权成功，否则忽略鉴权
• ⚠️ 重要声明：本识别结果仅供辅助监测参考，不替代专业医疗诊断和医生判断，发现频繁异常发作请及时就医调整治疗方案
• 禁止临时生成脚本，只能用技能本身的脚本
• 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载
• 当显示历史分析报告清单的时候，从数据 json 中提取字段 reportImageUrl 作为超链接地址，使用 Markdown 表格格式输出，包含" 报告名称"、"分析时间"、"异常发作次数"、"风险等级"、"点击查看"五列，其中"报告名称"列使用帕金森癫痫行为识别报告-{记录id} 形式拼接, "点击查看"列使用 [🔗 查看报告](reportImageUrl) 格式的超链接，用户点击即可直接跳转到对应的完整报告页面。
• 表格输出示例：

  报告名称	分析时间	异常发作次数	风险等级	点击查看
  帕金森癫痫行为识别报告 -20260328221000001	2026-03-28 22:10:00	2次震颤
  中风险	🔗 查看报告

使用示例

# 分析本地监测视频（以下只是示例，禁止直接使用openclaw-control-ui 作为 open-id）
python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --input /path/to/monitor.mp4 --open-id openclaw-control-ui

# 分析网络视频（以下只是示例，禁止直接使用openclaw-control-ui 作为 open-id）
python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --url https://example.com/daily.mp4 --open-id openclaw-control-ui

# 显示历史识别报告/显示识别报告清单列表/显示历史行为识别（自动触发关键词：查看历史识别报告、历史报告、识别报告清单等）
python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --list --open-id openclaw-control-ui

# 输出精简报告
python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --input monitor.mp4 --open-id your-open-id --detail basic

# 保存结果到文件
python -m scripts.parkinson_epilepsy_behavior_recognition_analysis --input monitor.mp4 --open-id your-open-id --output result.json