Medical Record Structurer

Medical record structuring and standardization tool. Converts doctor's oral or handwritten medical records into standardized electronic medical records (EMR)...

This skill's core functionality (structuring medical text) is coherent with its docs, demo, and EMR schema, but there are multiple red flags you should address before installing or running it with real PHI: - Audit self-modifying/autoupdate code: The repo includes auto-evolve-daemon.sh and scripts/self_evolve.py plus an evolution log indicating automated version changes. Do NOT run these without a human code review; they can change the skill's code or behavior over time. - Inspect upload/remote scripts: There is an upload-to-clawhub.sh and payment/billing integration. Review any scripts that call external endpoints (skillpay.me or other hosts) to confirm what data is sent. The docs claim no PHI is stored or transmitted, but metadata.schema includes source_text (original input) and demo output returns structured_record including original content — that could leak PHI if sent to a remote service. - Credentials and env vars: Although registry metadata lists no required env vars, the README and SKILL.md expect SKILLPAY_API_KEY and SKILLPAY_SKILL_ID (and optional OCR/STT keys). Only provide API keys to this skill after auditing network calls and confirming the recipient endpoints. - Run in an isolated environment first: Test the demo in an isolated VM/container with no real PHI and with network disabled (or monitored) to observe outbound calls. Verify that no unexpected files are created outside ~/.openclaw/ and that trial files do not contain raw PHI. - Prefer reviewing full source: Several files are large/truncated in the package preview; inspect scripts/self_evolve.py, scripts/subscription.py, and upload-to-clawhub.sh fully to ensure they don't fetch/execute code from untrusted hosts or exfiltrate data. - If you need to use with real PHI: require a legal/privacy review and run under institutional controls (audit logging, encryption keys you control, network egress filtering). If you are not comfortable auditing the code, do not install it for processing real patient data. If you want, I can: (1) highlight specific lines or functions to inspect (e.g., network calls, subprocess.exec/use, file writes), or (2) attempt a deeper static review of the full scripts (provide contents of self_evolve.py, subscription.py, and upload-to-clawhub.sh) to give a more definitive recommendation.

Type: OpenClaw Skill Name: medical-record-structurer Version: 1.4.0 The skill bundle contains a high-risk 'self-evolution' mechanism (scripts/self_evolve.py) and a background daemon (auto-evolve-daemon.sh) that programmatically modifies the skill's own source code. This mechanism appears to be malfunctioning, as evidenced by hundreds of redundant import statements injected into 'scripts/process_record.py'. While the stated purpose is medical record structuring with SkillPay monetization, the ability for the code to autonomously modify itself is a significant security concern. Furthermore, the bundle includes aggressive promotional content and requests donations to an EVM address (0xf8ea28c182245d9f66f63749c9bbfb3cfc7d4815), which, combined with the unstable self-modifying logic, warrants a suspicious classification.