Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

sjht-cam-anno

v1.0.0

安防摄像头视频 VL 模型微调数据集标注工具。用于从安防摄像头视频中提取关键帧、分析视频内容、生成结构化标注(含环境/人物/行为/风险描述),并输出符合 dataset.jsonl 格式的微调训练数据。Use when 用户需要对安防摄像头视频进行数据标注、生成 VL 模型训练数据集、处理 /root/hair-...

1· 147·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (CCTV video annotation) matches the included scripts (frame extraction and JSONL builder). However, the SKILL.md and scripts rely on external binaries (ffmpeg/ffprobe) and an agent 'read' tool, but the registry metadata declares no required binaries or config paths. The SKILL.md also repeatedly references 'hair-cam' and an absolute path fragment '/root/hair-cam' while the package slug/name is sjht-cam-anno — this name/path mismatch and missing declared runtime dependencies are inconsistent with the stated purpose.
Instruction Scope
The runtime instructions stay within annotation scope: extract frames, inspect images, generate structured annotations, and build dataset.jsonl. They instruct the agent to use a 'read' tool to open frame images and to infer metadata from filenames. This is privacy-sensitive (detailed physical descriptions of people) but consistent with the tool's purpose. The instructions reference processing a specific path (e.g., /root/hair-cam) which could encourage scanning or operating on system/root directories — that should be clarified/limited.
Install Mechanism
There is no install spec (instruction-only plus two small scripts). That is low-risk from an installation code-fetch perspective. The included scripts are local and do not download or execute remote code.
Credentials
No environment variables, credentials, or config paths are requested. The scripts only access local files and spawn ffmpeg/ffprobe. This access is proportionate to the stated task. Note: lack of declared binaries (ffmpeg/ffprobe) is an omission but not a secret/credential overreach.
Persistence & Privilege
The skill does not request persistent/always-on privileges, does not modify other skills or global agent settings, and will only run when invoked. No autonomous always:true flag is set.
What to consider before installing
Before installing or running this skill, consider the following: - Verify ffmpeg and ffprobe are installed and available on the PATH. The scripts call these binaries via subprocess but the skill metadata does not declare them as requirements. - Confirm the 'read' tool referenced in SKILL.md is available in your agent/runtime (it's an agent UI/tool to open images); otherwise adjust instructions to use an available image viewer. - The SKILL.md and files use the name 'hair-cam-anno' while the registry slug is 'sjht-cam-anno' — ask the publisher or inspect provenance to ensure this package is legitimate and unmodified. - The instructions mention processing '/root/hair-cam' (absolute path). Do not run the tool against system/root directories unless you intentionally want to process those files; point it at a controlled dataset directory instead. - Privacy and legal: the tool is designed to generate detailed descriptions of people (age, appearance, actions). Ensure you have consent and legal authority to process and store CCTV footage and derived datasets; consider redacting or avoiding personally identifying attributes. - Data handling: the build_jsonl script writes relative/declared paths into dataset.jsonl (it uses 'data/{video_name}' as image paths). Verify these paths meet your training pipeline expectations and that sensitive images are stored/handled securely. - Run the scripts in an isolated environment (sandbox or container) when first testing. Inspect logs/output for unexpected behavior; nothing in the code performs network calls but testing in isolation reduces risk. - If you require the skill to be deployable across different environments, update the metadata to declare required binaries and clarify the expected directory layout and the 'read' tool dependency. If you want, I can: (1) point out the exact lines to change to declare binaries, (2) produce a minimal wrapper to validate ffmpeg presence before running, or (3) produce a safer system-prompt variant that avoids sensitive PII extraction.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f7bes39vmaxqtw0p0htej6h834b0x
147downloads
1stars
1versions
Updated 2h ago
v1.0.0
MIT-0

hair-cam-anno — 安防摄像头视频标注

对安防摄像头拍摄的视频进行帧提取、视觉分析、结构化标注,输出 dataset.jsonl 格式的 VL 模型微调数据集。

工作流程

第1步:提取视频帧

python3 <skill>/scripts/extract_frames.py \
  --data-dir <视频目录> \
  --output-dir <帧输出目录> \
  --fps 0.5 \
  --max-frames 4
  • 从每个视频均匀提取 4 帧(每2秒一帧)
  • 生成 manifest.json 记录每个视频的元信息和帧路径

第2步:逐视频分析标注

对每个视频:

  1. 查看提取的帧:用 read 工具读取帧图片(支持 jpg/png)
  2. 从文件名推断信息:文件名包含关键信息(如 海尔摄像头-1男1女-坐-2 → 品牌=海尔摄像头, 1男1女, 行为=坐)
  3. 生成标注 JSON:根据帧画面内容 + 文件名信息,生成结构化标注

标注 JSON 结构:

{
  "title": "场景标题",
  "subtitle": "场景副标题",
  "description": "详细描述(≥50字,含环境、人物外貌、行为姿态)",
  "labels": ["system_suggest_X", ...],
  "risk": {
    "level": "none|low|medium|high",
    "description": "风险描述"
  },
  "simple_description": "简练描述(≤20汉字)"
}

第3步:汇总生成 dataset.jsonl

  1. 将所有标注结果收集到 annotations.json,格式:
[
  {"video": "文件名.mp4", "annotation": { ...标注JSON... }},
  ...
]
  1. 运行构建脚本:
python3 <skill>/scripts/build_jsonl.py \
  --annotations annotations.json \
  --video-dir <视频目录> \
  --output dataset.jsonl
  1. 脚本会自动验证标注数据并生成 dataset.jsonl

关键参考

  • System prompt 模板: references/system-prompt.md
  • 标签范围: references/labels-reference.md

标签选择规则

  • 根据视频实际内容选择匹配标签
  • 可多选,但不要选不匹配的标签
  • 如果视频中有危险行为(儿童攀爬窗户、摔倒等),risk.level 应为 medium 或 high
  • 文件名中的信息(人数、行为)必须与标注一致

Comments

Loading comments...