med-critical-disease-review

重大疾病理赔智能评估（支持 28 种病种）。输入住院病历结构化数据，调用内网评估接口，输出原始 JSON 与自然语言结论（结论 + 证据）。

Key things to check before installing or running this skill: - Endpoint sanity: Confirm which endpoint will actually receive medical data — the SKILL.md mentions an internal IP (10.10.20.15:9010) but the code posts to https://shangbao.yunzhisheng.cn/.... Ask the maintainer which endpoint is intended and whether it is within your trusted network. - Privacy promises vs. code behavior: The README claims PII will be stripped and nothing is persisted, but the visible code does not show any de-identification and it writes API responses and text summaries to ../runs by default. If you need to send PHI, require a proof of the redaction implementation or add a validation step yourself. Consider running with synthetic data first. - Network/data exposure: This skill will transmit structured medical records to a remote service. If your organization restricts outbound network traffic for sensitive health data, run the skill in an isolated environment or block outbound access until you can verify the endpoint and its retention/processing policies. - Local persistence: If you want to avoid files being written, run with explicit output paths (or inspect/run the code and remove/write-protection for save points). Search the full run.py for any other write operations (the provided run.py was truncated in the package listing). - Testing and audit: Review the full run.py (the package listing is truncated) to confirm there are no hidden calls or additional endpoints. Test using non-sensitive sample records that simulate structure but contain no real patient identifiers. Given these inconsistencies (endpoints, privacy claims vs code writes), treat the skill as suspicious until the author clarifies the redaction logic, the actual network destination, and data retention behavior.

Type: OpenClaw Skill Name: med-critical-disease-review Version: 1.0.1 The skill bundle facilitates medical insurance claim assessments by processing various document formats and calling a remote API (shangbao.yunzhisheng.cn). It exhibits high-risk behaviors, including the execution of external system binaries (LibreOffice, Tesseract, pdftotext) via subprocess to parse user-supplied files and outbound network requests containing sensitive medical data. While these capabilities are plausibly necessary for the stated purpose, there is a notable discrepancy where the implementation in scripts/run.py lacks the PII de-identification logic explicitly claimed in the SKILL.md documentation, posing a data privacy risk.