Intelligent Triage Symptom Analysis

This package is not clearly malicious, but it contains several red flags you should address before using it with real patient data or on production systems: 1) Do not run it on machines containing PHI until you confirm what is written to disk. The code writes assessments to ~/.openclaw/symptom_history and trial data to ~/.openclaw/skill_trial — contrary to some docs that claim no medical data is stored. 2) Resolve env var inconsistencies. The code expects SKILLPAY_API_KEY and SKILLPAY_SKILL_ID, but README/config reference SKILL_BILLING_API_KEY and SKILL_ID and other optional keys. Decide which names are authoritative and only supply billing keys when you’re ready to accept networked billing calls. 3) Audit network behavior. The billing client posts to https://skillpay.me/api/v1/billing/charge. Grep the code for any other outbound network calls before allowing it on a network-connected host. Run the skill in an isolated/test environment and monitor outbound traffic. 4) Inspect/disable auto‑evolution. The repo includes auto-evolve-daemon.sh and scripts/self_evolve.py. self_evolve.py is benign as shipped, but a daemon that periodically runs an evolution script raises the potential for future self-modifying or auto-update behavior. Don't enable the daemon unless you understand its update mechanism and trust the source. 5) Confirm logging and retention. The skill writes logs and JSON files to your home directory; check file permissions, whether sensitive inputs are stored, and whether you need encryption or manual deletion policies. 6) Ask the author for clarification. The package mixes versions and promotional text, and the metadata on required env vars is missing; request clear documentation of: - authoritative env var names - exactly what is sent to the billing endpoint - what persistent files are kept and what they contain - whether any automatic update/self-evolution will fetch code from remote hosts 7) If you plan to integrate into healthcare workflows, perform a clinical and security review: run unit tests, review red-flag detection logic, and ensure compliance with applicable regulations (HIPAA/GDPR). If you want, I can extract the specific lines where env vars and file writes occur, show all places the code performs network IO, or produce a minimal patch to disable persistence and the daemon for safe local testing.