Regional Humanoid Detection Skill | 区域人形检测技能

Key things to consider before installing: - Contradictory behavior: SKILL.md forbids reading local memory, but the code reads/writes local config and a SQLite DB and may save uploaded attachments. Ask the author to explain why local persistence is needed and whether the 'no local memory' rule is enforced by runtime checks. - Data exfiltration is expected but important: local video files are uploaded (multipart/form-data) to external APIs, or remote URLs are fetched by the API service. Check and approve the exact API endpoints in skills/smyx_common/scripts/config.yaml (the repo includes base URLs pointing to lifeemergence domains and dev/test hosts). If you need privacy, do not upload sensitive footage until you verify the service and agreements. - Hidden env/config dependencies: the skill does not declare required env vars, yet it reads OPENCLAW_SENDER_OPEN_ID, OPENCLAW_WORKSPACE, and may rely on API keys in config YAML. Ensure no sensitive credentials are present on your environment or in workspace config.yaml before use. - Broad codebase: the repo contains many unrelated components (pet/health/face-analysis artifacts and a large common library). This increases the attack surface and makes auditing harder. If you only need basic local human-detection, ask for a minimal implementation or sanitize the code. - Practical steps: review skills/smyx_common/scripts/config.yaml and config-dev/test files to confirm endpoints; inspect skills/smyx_common/scripts/util.py (RequestUtil and CommonUtil) to see exactly how HTTP requests are made and what headers/credentials are sent; test in an isolated environment with no sensitive credentials and with dummy videos; and request source/homepage/maintainer info since the skill's source is 'unknown'. If you cannot verify endpoints and the code paths that persist data, treat this skill as untrusted for sensitive video or credentials.