Incident Review

What inspired us

Anyone who has run a camera system knows the feeling. Something goes wrong on premises a delivery goes missing, a door is left open, an item turns up damaged and someone says, "Let's check the footage." What follows is hours of scrubbing through timelines frame by frame, hoping to spot the one moment that matters. In a real workplace this work is slow, easy to get wrong, and often simply abandoned because it costs more time than the answer is worth.

We wanted to flip that. Instead of a person searching footage, the NAS should already know what happened because it recorded the events as they occurred.

What we learned

The biggest lesson was that this is possible, not aspirational. UGREEN's AI NAS already runs local AI detection on recorded video for intrusion, face, vehicle, pet, and package events, and it builds a local index so recordings can be searched. All of that lives on the device; nothing is sent to the cloud.

We also learned how much the "local" part changes the design. Because the AI runs on the NAS itself, a Skill can summarize sensitive footage without that footage ever leaving the box which is exactly why an incident-review tool belongs on a NAS and not in a browser tab.

Finally, we learned the discipline of honest framing. The system can tell you when and where something happened and hand you the evidence; it cannot name a stranger. Saying that plainly is what makes the tool trustworthy.

How we built it

We built the Skill against UGREEN's official Uliya Skill Development Standard, using the uliya-skill-kit creation tool and its public capability catalog as the single source of truth.

The workflow delegates to specialized experts instead of doing NAS work directly:

• ug-surveillance → security-monitor-agent retrieves the real event timeline and one evidence snapshot or clip per event.
• ug-photo → photo-agent optionally describes the evidence images on-device.
• ug-knowledge → knowledge-agent saves the finished brief.

SKILL.md defines the goal, the required input, the capability evidence, the delegation order, and the handling of every result state (completed, failed, cancelled, waiting_user, waiting_approval). It then passes the official static checker with zero errors and zero warnings. The project proposal itself was typeset in Typst.

A simple way to think about the value is the time it removes:

$$ T_{\text{manual}} \approx N \cdot \bar{t} $$

Here N is the number of frames or minutes a human scrubs, each taking an average time. Incident Review replaces that whole effort with a single retrieval step, so the saving is:

$$ \Delta T = T_{\text{manual}} - T_{\text{triage}} $$

Because triage takes only seconds, the saving is large.

The challenges we faced

The first challenge was feasibility: proving this rests on a real feature rather than a hope. We read UGREEN's own monitoring documentation to confirm that local AI event detection and AI-based retrieval actually ship.

The second was the strictness of the submission standard. The static checker forbids scripts, credentials, direct capability calls, and any capability not in the catalog, so we had to express the whole workflow as clean delegation and say exactly what we meant.

The third was resisting overclaim. It is tempting to promise "find the thief." The true, defensible claim is "find the moments" and keeping that line is itself part of the engineering.

Built With

• markdown
• skills
• uliya-skill-kit