chronic-disease-review

• Analyzed: May 14, 2026, 7:39 AM
• Findings: 1
• Version: 1.0.0
• Hash: 05e4b5cd8e4565b901fe92a60fb76f5fa8ec8487b790aaa40fa554b82663e10b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill exhibits a significant discrepancy between its documentation and implementation regarding data privacy. While SKILL.md claims 'strict desensitization' of PII before transmission, scripts/chronic_disease_review.py sends the raw OCR input directly to an external endpoint (shangbao.yunzhisheng.cn). Additionally, the script writes output files to paths outside its own directory structure (../runs/), which is a risky behavior. These issues represent a high privacy risk and potential data leak, though they appear to be critical vulnerabilities or poor implementation rather than intentional malware.