Medical Record Structurer

This skill's core functionality (structuring medical text) is coherent with its docs, demo, and EMR schema, but there are multiple red flags you should address before installing or running it with real PHI: - Audit self-modifying/autoupdate code: The repo includes auto-evolve-daemon.sh and scripts/self_evolve.py plus an evolution log indicating automated version changes. Do NOT run these without a human code review; they can change the skill's code or behavior over time. - Inspect upload/remote scripts: There is an upload-to-clawhub.sh and payment/billing integration. Review any scripts that call external endpoints (skillpay.me or other hosts) to confirm what data is sent. The docs claim no PHI is stored or transmitted, but metadata.schema includes source_text (original input) and demo output returns structured_record including original content — that could leak PHI if sent to a remote service. - Credentials and env vars: Although registry metadata lists no required env vars, the README and SKILL.md expect SKILLPAY_API_KEY and SKILLPAY_SKILL_ID (and optional OCR/STT keys). Only provide API keys to this skill after auditing network calls and confirming the recipient endpoints. - Run in an isolated environment first: Test the demo in an isolated VM/container with no real PHI and with network disabled (or monitored) to observe outbound calls. Verify that no unexpected files are created outside ~/.openclaw/ and that trial files do not contain raw PHI. - Prefer reviewing full source: Several files are large/truncated in the package preview; inspect scripts/self_evolve.py, scripts/subscription.py, and upload-to-clawhub.sh fully to ensure they don't fetch/execute code from untrusted hosts or exfiltrate data. - If you need to use with real PHI: require a legal/privacy review and run under institutional controls (audit logging, encryption keys you control, network egress filtering). If you are not comfortable auditing the code, do not install it for processing real patient data. If you want, I can: (1) highlight specific lines or functions to inspect (e.g., network calls, subprocess.exec/use, file writes), or (2) attempt a deeper static review of the full scripts (provide contents of self_evolve.py, subscription.py, and upload-to-clawhub.sh) to give a more definitive recommendation.