Mxyj Heartplus Ecg

这是一个用于心脏+ App 的心电健康管理技能，主要功能包括：1.发送心电检测通知并联动 Apple Watch 获取心电时序数据；2.基于心电时序数据通过心电分析算法输出报告与解读；3.查询已生成的心电分析报告（历史、最新、指定报告）。本技能需与心脏+ App 配合使用，使用前请先在 iPhone 上安装并登录...

What to check before installing or running this skill: - Verify the external installers and binaries: the skill will (a) suggest installing 'uv' via a script hosted at astral.sh and (b) download and execute 'healthgateway' binaries from an OSS URL. Ask the author for signed releases or independent verification (signed artifacts or reproducible sha256 checks). Manually compare the downloaded files' sha256 hashes with those in config.json before execution. - Audit endpoints: the API base_url (default https://api.995120.cn) and the OSS host are external services you will contact. Confirm you trust these services and understand their privacy/security policies. - Consider running in a sandbox: because the skill downloads and executes binaries and makes network calls, run it in an isolated environment (container or VM) if you want to limit blast radius. - Review data flow and privacy: the skill stores phone numbers and session authorization state locally and requires session-key values to operate. Ensure you are comfortable with local storage of phone numbers and with an agent returning raw script outputs — if a script produces unexpected fields, the policy requires the agent to paste them verbatim. - Ask the developer for clarification: request the canonical source for 'uv' (official package or trusted repo) and provenance/signature for the healthgateway binaries; ask for evidence that the astral.sh installer is safe or a recommended alternative (e.g., install from official package manager). - If you cannot verify the binaries or sources, do not run the automatic installer; instead manually vet and install needed tools from trusted sources, and only run scripts after verifying hashes. If you want, I can: - Extract and list all external URLs and binaries the skill uses (install scripts, API endpoints, OSS links, sha256 values) so you can verify them, - Or produce a concise checklist and commands to verify downloaded file hashes and to run the skill safely in a sandboxed environment.

Type: OpenClaw Skill Name: mxyj-heartplus-ecg Version: 0.0.7 The skill facilitates ECG health management by interacting with the 'Heart+' App API (api.995120.cn). A significant security risk is identified in `gateway_manager.py`, which automatically downloads and executes platform-specific binaries from an external Aliyun OSS bucket (`aigc-online.oss-cn-hangzhou.aliyuncs.com`) to handle encrypted API communication. While this is aligned with the stated purpose of the skill, the execution of remote binaries is a high-risk capability. Additionally, `SKILL.md` contains highly prescriptive 'critical instructions' designed to strictly steer the AI agent's behavior and output formatting, and the skill collects user phone numbers which are stored locally in `config.json`.