health-reasoner

AdvisoryAudited by Static analysis on May 9, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If you enable history, health-related scores and risk details may remain on disk and should be treated as private.

Why it was flagged

The tool processes health-related profile fields and can persist assessment history when a history file is configured.

Skill content
medical_history: List[str] = None ... if not self.history_file: return ... json.dump(self.history, f, indent=2, ensure_ascii=False)
Recommendation

Use the history option only when you want local tracking, store the file in a private location, and delete it when no longer needed.

What this means

Running the setup script and choosing API support will install a third-party package from pip.

Why it was flagged

The setup script optionally installs Flask without a pinned version, which is a normal but noticeable package-supply-chain choice for API mode.

Skill content
read -p "是否安装 Flask 以启用 API 服务? (y/N): " ... pip3 install flask
Recommendation

Only install Flask if you need API mode, and consider pinning or reviewing the package version in controlled environments.