Mentx Doctor 医疗助手

基于提出的医疗相关问题，通过 api上传医疗相关图片和文字（表征、内窥镜影像、X光、CT、MRI、超声、心电、各类检测报告等），获取专业医疗辅助决策报告支持。

This skill appears to do what it says (send text/images to Mentx API and return a report) but has two important red flags: (1) the registry metadata fails to declare the required MENTX_API_KEY even though SKILL.md and scripts require it — confirm where that key comes from and whether you trust the developer and key handling; (2) the skill uploads medical images/reports (sensitive personal health information) to an external host (developer.mentx.com). Before installing, verify the vendor/domain and their privacy/retention policy, ensure you have user consent to transmit PHI, avoid putting a long-lived production API key in global shell startup files (use limited-scope or ephemeral keys), and consider testing with non-sensitive data first. If you cannot verify the service's identity and data handling, do not provide real patient data or your primary API key.

Type: OpenClaw Skill Name: mentx-doctor Version: 2.0.0 The skill bundle contains a critical shell injection vulnerability in `scripts/mentx-api.sh`. User-supplied medical descriptions and messages are passed as command-line arguments and expanded within a shell heredoc without sanitization, allowing for arbitrary command execution (RCE) on the host system. While the script's logic and the instructions in `SKILL.md` appear aligned with the stated purpose of medical reporting via `developer.mentx.com`, the implementation is dangerously insecure and allows for potential exploitation by a user providing crafted input.