unisound-similar-case-retrieval
PassAudited by ClawScan on May 15, 2026.
Overview
The skill’s behavior matches its medical research case-ranking purpose, but it sends the case summaries you provide to a disclosed LLM API using an app key, so only approved de-identified data should be used.
Before installing, verify the publisher/package identity, use a protected app key, and only process de-identified, ethics-approved case summaries. Treat the output as research assistance, not clinical advice.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Clinical case summaries can leave the local environment for model processing; if they contain real patient identifiers, this could expose sensitive medical data.
The code posts the prompt assembled from anchor_case and candidate_cases to the disclosed remote medical LLM endpoint.
API_URL = "https://maas-api.hivoice.cn/v1/chat/completions" ... text = call_llm(SYSTEM, user, appkey)
Use only de-identified, approved case summaries and confirm the endpoint’s data-processing and compliance terms before sending real clinical data.
Anyone who can see or reuse the app key may be able to access the model service under that credential.
The script requires a provider app key and sends it as a Bearer token; this is expected for the model API but is not declared as a primary credential in the registry metadata.
parser.add_argument("--appkey", required=True, help="内部医疗大模型鉴权 key。") ... {"Authorization": f"Bearer {appkey}"}Use a least-privilege app key, avoid exposing it in shared shell history or logs, and rotate it if it may have been disclosed.
The mismatch may make it harder to confirm the exact publisher/package identity.
The packaged metadata differs from the supplied registry owner/slug/published timestamp, creating a provenance inconsistency even though the included code itself is straightforward.
"ownerId": "kn76wejkeqxfc03j0rfxp2jaj982m7aa", "slug": "doctor.clinical-research.similar-case-retrieval", "publishedAt": 0
Verify the publisher and version in ClawHub before relying on the skill in a regulated workflow.