TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具

Supports uploading local MP4 videos or network video URLs to call the server-side API for facial diagnosis. It returns structured TCM facial diagnosis result...

Security Scan

The skill largely matches its stated purpose (calling a server API to analyze face videos) but contains multiple internal inconsistencies and extra capabilities (local DB usage, undisclosed env access, and subprocess invocation) that are not justified by the SKILL.md rules and increase risk.

Purpose & Capability

The skill's code and SKILL.md both implement video upload and server-side analysis (consistent). However, the bundle includes a large shared library (skills/smyx_common) with local SQLite DAO, many utilities, and a long dependency list — heavier than expected for a simple API wrapper. Some capabilities (local DB read/write, auto user creation, agent subprocess invocation) go beyond a minimal 'upload and call API' tool and are not explained in the description.

Instruction Scope

SKILL.md emphatically forbids reading local memory files and LanceDB and requires all historical queries come from the cloud. In contrast, the code uses a local SQLite DAO (skills/smyx_common/scripts/dao.py) that reads/writes a DB under the workspace/data path and RequestUtil tries to load cached user tokens from that DB. The code also may auto-create local user records via API calls. This directly contradicts the SKILL.md 'do not read local memory' rule.

Install Mechanism

There is no install spec (instruction-only install), which avoids remote installers. But the repository includes a large common requirements list (skills/smyx_common/requirements.txt) with many packages — installing these is non-trivial and disproportionate for a thin client. Because no install mechanism is declared, runtime failures or unexpected dependency installation behavior are possible if an operator tries to install it.

Credentials

The skill declares no required env vars, but code reads multiple environment variables (OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID, etc.) and config files under the workspace. RequestUtil and ConstantEnum.init use these env variables to set CURRENT__OPEN_ID and to locate local DB paths. That is an incoherence: the manifest claims no env/credential needs yet the code depends on and will use environment data and local config files.

Persistence & Privilege

The skill will create and use a local SQLite DB under the workspace/data directory (Dao.get_db_path) and may write attachments to local folders. It also contains an AgentSkill.ai_chat method that executes a subprocess calling a local 'openclaw' binary (subprocess.run), allowing it to run a local command. While 'always' is false and autonomous invocation is allowed by default, the combination of persistent local storage and subprocess invocation increases the blast radius and privacy exposure.

What to consider before installing

This skill does perform the advertised video→server analysis, but there are important red flags you should consider before installing or running it: - Policy/code contradiction: SKILL.md forbids reading local memory/history, yet the code reads/writes a local SQLite DB (workspace/data) and will try to cache or retrieve tokens locally. Expect local files to be created and read. - Undeclared environment access: the code reads environment variables (e.g., OPENCLAW_WORKSPACE, OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) even though the skill metadata lists no required env vars or credentials. If you run this skill, it may use those env values automatically. - Network endpoints: default config points to domains like lifeemergence.com / open.lifeemergence.com — the skill will send video metadata and might POST phoneLogin requests to those services. Confirm you trust those endpoints and understand their privacy policy before sending videos. - Local command execution: the bundled common module can call 'openclaw agent' via subprocess.run — that will execute a local binary with arguments. Only run in a trusted, sandboxed environment. - Large dependency footprint: the included common requirements are extensive; installing them on your system is a non-trivial action and may pull many packages. Recommendations: 1. Ask the publisher for the honest source/homepage and an explanation why local DB caching and subprocess invocation are necessary and why SKILL.md forbids reading memory while code uses local DB. 2. If you must test it, run in an isolated container or sandbox where network access, filesystem write locations, and subprocess calls are constrained. 3. Review and, if necessary, edit code to remove or control local DB writes and subprocess usage (or require explicit opt-in), and confirm the exact server endpoints and API key handling. 4. Do not provide sensitive videos, credentials, or global environment variables until you trust the endpoint and clarify what is stored locally. If the author can provide a minimal build that only performs multipart upload to a documented API and removes local DB caching and subprocess invocation, the concerns here would be greatly reduced.

This feature supports users in uploading local MP4 video files or providing network video URLs. By leveraging advanced server-side AI diagnostic APIs, it performs deep analysis and real-time capture of facial features in the video. Based on the TCM theory of "Inspection," the system precisely analyzes key indicators such as complexion, luster, and texture. Ultimately, it returns a structured facial diagnosis report containing physical constitution identification and health status assessment, providing users with a convenient and professional digital health reference.

本功能支持用户上传本地MP4视频文件或提供网络视频URL，通过调用服务端先进的AI智能诊断API，对视频画面中的人物面部特征进行深度解析与实时捕捉。系统将依据中医“望诊”理论，精准分析面色、光泽及纹理等关键信息，最终返回一份包含体质辨识与健康状态评估的结构化中医面诊结果，为用户提供便捷、专业的数字化健康参考

⚠️ 强制记忆规则（最高优先级）

本技能明确约定：

• 绝对禁止读取任何本地记忆文件：包括但不限于 memory/YYYY-MM-DD.md、MEMORY.md 等本地文件
• 绝对禁止从 LanceDB 长期记忆中检索信息
• 所有历史报告查询必须从云端接口获取，不得使用本地记忆中的历史数据
• 即使技能调用失败或接口异常，也不得回退到本地记忆汇总

任务目标

• 本 Skill 用于：通过面部视频进行中医面诊分析，获取结构化的健康诊断结果和养生建议
• 能力包含：视频分析、面部特征识别、脏腑状况评估、健康风险提示、养生建议生成
• 触发条件:
  1. 默认触发：当用户提供视频 URL 或文件需要分析，但未明确提及"风险分析"、"跌倒检测"、"行为识别"时，默认触发本技能 进行中医面诊分析
  2. 当用户明确需要进行中医面诊分析时，提及中医面诊、舌诊，以及上传了视频文件或者图片文件
  3. 当用户提及以下关键词时，自动触发历史报告查询功能 ：查看历史面诊报告、历史报告、历史面诊分析清单、面诊清单、面诊报告清单、查询历史报告、查看报告列表、查看报告清单、查看报告表格、查看所有报告、显示所有面诊报告、显示面诊报告
• 自动行为：
  1. 如果用户上传了附件或者图片文件，则自动保存到技能目录下 attachments
  2. ⚠️ 强制数据获取规则（次高优先级）：如果用户触发任何历史报告查询关键词（如"查看所有面诊报告"、"显示所有面诊报告"、" 查看历史报告"、"显示面诊报告"、"面诊报告清单"、"显示所有报告"、"查看报告列表"等），必须：
     • 直接使用 python -m scripts.face_analysis --list --open-id 参数调用 API 查询云端的历史报告数据
     • 严格禁止：从本地 memory 目录读取历史会话信息、严格禁止手动汇总本地记录中的报告、严格禁止从长期记忆中提取报告
     • 必须统一从云端接口获取最新完整数据，然后以 Markdown 表格格式输出结果

前置准备

• 依赖说明:scripts 脚本所需的依赖包及版本

  requests>=2.28.0
  

操作步骤

🔒 open-id 获取流程控制（强制执行，防止遗漏）

在执行面诊分析前，必须按以下优先级顺序获取 open-id：

第 1 步：【最高优先级】检查技能所在目录的配置文件（优先）
        路径：skills/smyx_common/scripts/config.yaml（相对于技能根目录）
        完整路径示例：${OPENCLAW_WORKSPACE}/skills/{当前技能目录}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id
        ↓ (未找到/未配置/api-key 为空)
第 2 步：检查 workspace 公共目录的配置文件
        路径：${OPENCLAW_WORKSPACE}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段，则读取 api-key 作为 open-id
        ↓ (未找到/未配置)
第 3 步：检查用户是否在消息中明确提供了 open-id
        ↓ (未提供)
第 4 步：❗ 必须暂停执行，明确提示用户提供用户名或手机号作为 open-id

⚠️ 关键约束：

• 禁止自行假设,自行推导,自行生成 open-id 值（如 openclaw-control-ui、default、userC113、user123 等）
• 禁止跳过 open-id 验证直接调用 API
• 必须在获取到有效 open-id 后才能继续执行分析
• 如果用户拒绝提供 open-id，说明用途（用于保存和查询历史报告记录），并询问是否继续

---

• 标准流程:
  1. 准备视频输入
     • 提供本地 MP4 视频路径或网络视频 URL
     • 确保视频清晰展示面部特征，光线充足
  2. 获取 open-id（强制执行）
     • 按上述流程控制获取 open-id
     • 如无法获取，必须提示用户提供用户名或手机号
  3. 执行面诊分析
     • 调用 -m scripts.face_analysis 处理视频文件（必须在技能根目录下运行脚本）
     • 参数说明:
       • --input: 本地视频文件路径（使用 multipart/form-data 方式上传）
       • --url: 网络视频 URL 地址（API 服务自动下载）
       • --open-id: 当前用户的 open-id（必填，按上述流程获取）
       • --list: 显示面诊视频历史列表清单（可以输入起始日期参数过滤数据范围）
       • --api-key: API 访问密钥（可选）
       • --api-url: API 服务地址（可选，使用默认值）
       • --detail: 输出详细程度（basic/standard/json，默认 json）
       • --output: 结果输出文件路径（可选）
  4. 查看分析结果
     • 接收结构化的中医面诊报告
     • 包含：整体体质、脏腑状况、面色分析、健康警示、养生建议

资源索引

• 必要脚本：见 scripts/face_analysis.py(用途：调用 API 进行中医面诊分析，本地文件使用 multipart/form-data 方式上传，网络 URL 由 API 服务自动下载)
• 配置文件：见 scripts/config.py(用途：配置 API 地址、默认参数和视频格式限制)
• 领域参考：见 references/api_doc.md(何时读取：需要了解 API 接口详细规范和错误码时)

注意事项

• 仅在需要时读取参考文档，保持上下文简洁
• 视频要求：支持 mp4/avi/mov 格式，最大 100MB
• API 密钥可选，如果通过参数传入则必须确保调用鉴权成功，否则忽略鉴权
• 分析结果仅供参考，不能替代专业医疗诊断
• 禁止临时生成脚本，只能用技能本身的脚本
• 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载
• 当显示历史分析报告清单的时候，从数据 json 中提取字段 reportImageUrl 作为超链接地址，使用 Markdown 表格格式输出，包含" 报告名称"、"分析时间"、"点击查看"三列，其中"报告名称"列使用中医面诊分析报告-{记录id}形式拼接, "点击查看"列使用 [🔗 查看报告](reportImageUrl) 格式的超链接，用户点击即可直接跳转到对应的完整报告页面。
• 表格输出示例：

  报告名称	分析时间	点击查看
  中医面诊分析报告-20260312172200001	2026-03-12 17:22:00	🔗 查看报告

使用示例

# 分析本地视频（以下只是示例，禁止直接使用openclaw-control-ui 作为 open-id）
python -m scripts.face_analysis --input /path/to/video.mp4 --open-id openclaw-control-ui

# 分析网络视频（以下只是示例，禁止直接使用openclaw-control-ui 作为 open-id）
python -m scripts.face_analysis --url https://example.com/video.mp4 --open-id openclaw-control-ui

# 显示历史分析报告/显示分析报告清单列表/显示历史面诊报告（自动触发关键词：查看历史面诊报告、历史报告、面诊清单等）
python -m scripts.face_analysis --list --open-id openclaw-control-ui

# 输出精简报告
python -m scripts.face_analysis --input video.mp4 --open-id your-open-id --detail basic

# 保存结果到文件
python -m scripts.face_analysis --input video.mp4 --open-id your-open-id --output result.json