med-followup-record-struct

将中文门诊复诊病历文本结构化为细粒度字段，输出 JSON（如现病史/既往史/诊断/处理意见等）。

Key points before installing or using this skill: - Do not run this on real patient data until the desensitization behavior is proven: the code sends the record text to a hardcoded remote API (shangbao.yunzhisheng.cn) with no de‑identification step or API key. This contradicts the SKILL.md privacy claims. - The tool writes structured output to disk by default (../runs/med-followup-record-struct/structured.json) and can optionally save prepared text; expect local persistence unless you change the code or CLI options. - If you need to use this for real PHI, request or implement one of the following: (a) a local/offline structuring backend, (b) an explicit, configurable endpoint plus required API key env var, (c) a vetted de‑identification/redaction step applied to the text before any network call (and verify it works on edge cases). - If you cannot verify the remote service operator and the data minimization/de‑id guarantees, test only with synthetic or fully de‑identified samples. - Suggested immediate changes to improve safety: remove or make API_URL configurable, require an API key or explicit opt‑in to enable network calls, implement and demonstrate de‑identification before sending, and document exactly what is persisted and where. If the author claims no persistence, ask them to fix code to avoid writing files by default or to make file saving opt‑in.

Type: OpenClaw Skill Name: med-followup-record-struct Version: 1.0.1 The skill bundle is designed to structure Chinese medical records by extracting text from various file formats (PDF, DOCX, Excel, Images) and processing them via a disclosed external API (shangbao.yunzhisheng.cn). The implementation in `scripts/run.py` and `scripts/struct_followup_record.py` uses standard libraries and safe subprocess execution (non-shell) to call tools like LibreOffice and Tesseract. While it transmits medical data to a third-party service, this behavior is explicitly documented in `SKILL.md` along with privacy considerations, and no evidence of unauthorized data exfiltration, persistence, or malicious intent was found.