Phenosnap Phenotype Extractor

Extract clinical phenotypes and medication entities from user-provided text using PhenoSnap, producing a timestamped JSON output.

This skill will download PhenoSnap from GitHub and run its Python code locally and may auto-install Python packages. Before installing/use: (1) supply hp.obo locally and set HPO_OBO_PATH; (2) review the upstream WGLab/PhenoSnap repository code to ensure you trust it; (3) run the skill in a restricted environment or virtualenv (avoid running as admin); (4) verify the redaction step on any sensitive clinical text — heuristics can miss identifiers; (5) be aware the skill will write timestamped input/output files under the chosen baseDir; (6) if you are uncomfortable with automatic pip/get-pip.py network installs or executing third‑party scripts, do not install or audit the repository first. The 'primaryEnv' label for HPO_OBO_PATH is unusual but not itself a secret-exfiltration signal.

Type: OpenClaw Skill Name: phenoskill Version: 0.1.1 This skill is classified as suspicious due to its high-risk capabilities involving the download and execution of external code and dependencies. Specifically, it downloads and executes `get-pip.py` from `bootstrap.pypa.io` and the `PhenoSnap` project from `github.com/WGLab/PhenoSnap`, followed by `pip install -r requirements.txt` (SKILL.md). While these actions are intended for legitimate dependency management and bootstrapping, they introduce significant supply chain vulnerabilities, as a compromise of any upstream source (GitHub, PyPI, pypa.io) could lead to arbitrary code execution on the host system. There is no evidence of intentional malicious behavior, such as data exfiltration (explicitly forbidden in SKILL.md) or persistence mechanisms, but the broad execution capabilities warrant a 'suspicious' classification.