healthcare-dev
Analysis
This is an instruction-only healthcare software development skill with purpose-aligned examples, but users should review any copied EHR/PHI-handling code carefully before using it.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
setInterval(() => { this.rotateEncryptionKey(); }, config.hipaa.keyRotationDays * 24 * 60 * 60 * 1000); ... 'UPDATE patients SET encrypted_data = $1, encryption_iv = $2, encryption_tag = $3 WHERE id = $4'The example shows automated key rotation and database updates across patient records. This is aligned with healthcare security, but it is high-impact behavior if adopted without safeguards.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
jwtSecret: process.env.JWT_SECRET!, ... password: process.env.DB_PASSWORD, ... password: process.env.REDIS_PASSWORD
The reference EHR code uses application secrets and service credentials, which is expected for the demonstrated system but would need least-privilege handling if implemented.