心理健康分析工具
WarnAudited by ClawScan on May 12, 2026.
Overview
The skill’s core video-analysis purpose is coherent, but it handles very sensitive mental-health video and report data with weakly bounded identity, storage, and data-sharing controls.
Install only if you are comfortable sending selected videos and mental-health report queries to the configured external service. Do not use it for other people without consent, avoid relying on phone/open-id as proof of authorization, remove bundled default identifiers, and confirm where uploaded videos and report history are stored or deleted.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A report query may depend on a guessable or shared identifier, which could expose or mix up sensitive mental-health records if the backend does not enforce stronger authorization.
The skill treats a username or phone number as the open-id used to save and query sensitive mental-health reports, while API key use is described as optional. The artifacts do not clearly show a scoped credential or consent boundary for report access.
必须暂停执行，明确提示用户提供用户名或手机号作为 open-id ... 用途（用于保存和查询心理分析报告记录） ... API 密钥可选
Use a provider-authenticated account or scoped token for report access, avoid phone numbers as the only access key, and make the authorization model explicit before installation.
Analyses or history queries could be associated with a bundled/default user identifier if the runtime falls back to it.
The bundled production config leaves api-key blank and includes a default open-id value that looks like a phone number. For a skill that saves and retrieves mental-health reports, a packaged default identifier can cause account-mixing or unintended report association.
api-key: ... default--open-id: "18069813808"
Remove hard-coded default user identifiers and require the current user to authenticate or explicitly provide a scoped identifier for each report operation.
Sensitive face/video and mental-health inputs may remain stored locally after the analysis task finishes.
The skill instructs the agent to automatically persist uploaded attachments or videos in the skill directory. These videos are used for mental-health and facial/behavior analysis, but the artifacts do not define retention, deletion, encryption, or user review controls.
如果用户上传了附件或者视频文件，则自动保存到技能目录下 attachments
Ask before saving uploaded videos, store only the minimum needed, document where files are kept, and provide a clear cleanup or retention policy.
When asking for report history, the user may receive full structured records or report links containing sensitive health details, not just a minimal list.
The active inherited history-listing code serializes the full API response and adds direct report image URLs. That may expose more historical health/mental-health report data in chat than the SKILL.md table-only description suggests.
if item.get("commonAiResponse") or item.get("healthAiResponse"):
item["reportImageUrl"] = _get_analysis_export_url(item.get("id"))
...
response_text = JsonUtil.stringify(response)Limit history output to the fields the user requested, redact detailed health responses by default, and require explicit confirmation before showing full historical reports or report links.
If the environment is switched to dev, sensitive videos and report requests could be sent to a private HTTP endpoint rather than the documented production service.
A development config points to an HTTP raw private IP endpoint. The default config uses prod, so this is not evidence of active exfiltration, but it is a risky alternate endpoint if enabled.
base-url-open-api: "http://192.168.1.234:9601/smyx-open-api"
Remove dev/private endpoints from published packages or clearly separate them from user-installable builds.
Users may treat the output as more clinically reliable or consent-safe than the artifacts support.
The description makes strong claims about automated mental-health quantification and screening contexts. The later disclaimer reduces risk, but users should not over-trust the analysis as a diagnosis or use it without consent.
the system accurately quantifies mental health status ... imperceptible and objective mental health assessment reports ... corporate employee care, campus psychological screening
Use the tool only as a non-diagnostic aid, obtain consent from people in videos, and consult qualified professionals for mental-health decisions.