miloco-miot-identity-register
家庭成员身份注册主流程。**用户表达「想让系统认识/记住/录入某个人」的意图就触发本 SKILL,不要求出现"注册/登记"字面词**——包括上传图/视频指明某人是谁、回应 `[感知引擎]` 陌生人推送、说"建档案/录入家人/记下样子"、指认摄像头里某人身份、从近期陌生人记录里挑人建档、撤销注册、查看某人样本。覆盖"上传图/视频"与"从摄像头挑人"两条通路,所有路径需用户确认才入库。仅改 person 行(改名/删人,不涉及样本)走 miloco-miot-identity。
95%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Critical
Do not install without reviewing
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The skill explicitly documents tooling to fetch camera "stranger" clusters, upload/commit people’s images/videos, and map camera IDs (including a 72h cluster retention), which enables systematic biometric collection and potential unauthorized surveillance or data exfiltration; no obfuscated/backdoor code or remote-exec constructs were found.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该技能在运行时会把用户消息/推送解析出的自由文本（如姓名、角色、摄像头口语指称与时间 hint）用于选择分支并直接参与工具参数映射（例如用于 `device list` 后的摄像头 `--cam` 匹配与 `pool fetch --window` 抽取），属于从外部输入到检索/取候选流程的直接暴露路径。
- Repository
XiaoMi/xiaomi-miloco
- Revision
a48c181
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.