Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
deepevidence循证医学AI助手
v1.0.10循证医学临床助手，采用 DeepEvidence 兼容 OpenAI 的 API（可追溯引用）。 用于解答复杂的临床问题、药物安全性证据、指南解读等。
⭐ 1· 315·0 current·0 all-time
bydeepevidence@cindy8753
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (evidence-based clinical Q&A) matches the code and SKILL.md: it calls a DeepEvidence OpenAI-compatible API at the documented base URL and requires an API key. However, the registry metadata claims 'Required env vars: none' while SKILL.md and scripts/chat.py clearly require DEEPEVIDENCE_API_KEY (and optionally use DEEPEVIDENCE_USER_ID). This metadata mismatch is unexpected and should be resolved.
Instruction Scope
SKILL.md defines tight, clinical-focused instructions (response formatting, emergency boundary, do-not-log rules) and the bundled script implements the core chat workflow against the specified base_url. The instructions do not direct the agent to read unrelated system files or other credentials. Caveat: some policy items (e.g., 'must not log PII') are normative and rely on operator discipline; the code accepts optional user-provided metadata (user/contact_id/display_label) which could include PII if callers supply it.
Install Mechanism
No install spec or remote downloads are present (instruction-only distribution with a local Python script). The script depends on the standard 'openai' Python package; there are no obscure URLs, archives, or extract operations. Risk from install mechanism is low.
Credentials
Requesting DEEPEVIDENCE_API_KEY is proportionate to the stated purpose. The concern is the inconsistency: the top-level registry metadata lists no required env vars while SKILL.md and the script require an API key. The script also accepts optional DEEPEVIDENCE_USER_ID and arbitrary metadata fields (contact_id/display_label) that could carry PII if misused. Confirming the registry metadata and being careful with what you pass as user/contact identifiers is recommended.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It prints responses and some metadata but does not persist credentials or install background services. Autonomous invocation is allowed by default (normal) and not combined here with other high-risk patterns.
What to consider before installing
This skill appears to be a legitimate DeepEvidence client, but verify a few things before installing: (1) the SKILL.md and scripts require DEEPEVIDENCE_API_KEY — the registry metadata incorrectly lists no required env vars, so do not assume no secrets are needed; (2) only provide non-PII values for optional user/contact fields (the code will send them to the service); (3) review the code yourself or test with non-sensitive queries to confirm the base URL (https://deepevid.medsci.cn/) is the intended endpoint; (4) ensure the API key you supply is from a trusted administrator and avoid committing it to source control; (5) remember this tool is not for emergency care — follow the emergency boundary instructions. If you need higher assurance, ask the publisher to fix the registry metadata and provide an audited release.Like a lobster shell, security has layers — review code before you run it.
latestvk97an1xszmve4wh97db72ep85h83mf0x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.