Mediwise Health Suite
WarnAudited by ClawScan on May 18, 2026.
Overview
This health-management skill is broadly purpose-aligned, but it includes risky instructions around sharing Garmin passwords in chat and has ambiguous cloud/vision data disclosures for sensitive medical data.
Review this skill carefully before installing. It appears designed for local family health tracking, but do not type wearable-account passwords into chat, verify multi-user isolation before using it in groups, and only enable cloud vision or backend sync if you understand exactly what health data will be sent and trust the destination.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could be led to type a real Garmin password into chat instead of a secure terminal prompt, exposing account credentials and wearable health data.
The README demonstrates the assistant asking for and receiving a Garmin Connect password in chat, which exposes account credentials to the conversation/model/logging path and grants access to a third-party health/wearable account.
助手：需要您的 Garmin Connect 登录邮箱和密码，凭据仅保存在本地... 用户："邮箱 xxx@gmail.com 密码 xxx"
Do not enter wearable-account passwords in chat. The skill should remove chat-based password examples and require a local terminal/OAuth flow with clear credential scope and storage.
If cloud vision or backend mode is enabled, medical reports, images, or complete health records may be sent outside the local device.
The skill discloses optional transmission of medical images and complete health records to external or user-configured endpoints. The vision row says images are sent as base64 while also implying no PII, which is ambiguous because medical images/PDFs can themselves contain names or IDs.
`setup.py set-vision` 启用视觉模型 | `api.siliconflow.cn` / Google / OpenAI 等 | 图片 base64 + 提示词（不含姓名/身份证等 PII） ... `setup.py set-backend` 启用后端 API | 用户自配置的端点 | **完整健康记录**
Use local/offline providers where possible, redact medical images before upload, and enable backend mode only for endpoints you fully control and trust.
In a shared bot or family group setup, a missing owner_id could make local health data visible or mutable outside the intended user boundary.
The code intentionally falls back to single-user mode when owner_id is absent, which is acceptable for a personal install but means shared/group deployments rely on the host correctly passing owner identity.
if (ownerId) { args.push('--owner-id', ownerId); } else { log('[diet-tracker] WARNING: owner_id not provided; operating in single-user mode (all local data accessible)'); }Before using this in group or multi-user environments, verify that OpenClaw passes a unique owner_id for each sender and test that users cannot see each other’s records.