Metabolic Healing Skill System
ReviewAudited by ClawScan on May 10, 2026.
Overview
No hidden code or install behavior was supplied, but the skill instructs agents to automatically maintain sensitive health and CRM records and safety workflows without clear consent, retention, or approval boundaries.
Install only if you are comfortable giving the agent sensitive health and service data. Treat outputs as drafts unless a qualified professional reviews them, and do not allow automatic CRM, calendar, billing, or health-record updates without explicit confirmation and clear privacy controls.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent has access to calendar, CRM, or service tools, it could create or alter appointments and customer records automatically, including sensitive health-related records.
These instructions move beyond drafting advice into automatic scheduling/resource coordination and CRM data entry. The artifacts do not require explicit user approval, dry-run review, rollback, or scoped permissions before such changes.
C8-06 预约与排程管理 ... AI自动匹配资源和排程，冲突自动协调; C8-21 CRM数据录入维护 ... CRM更新记录 ... AI自动提取和结构化录入交互数据
Require user confirmation before any CRM, calendar, billing, or operational update; keep a human-reviewed draft mode by default; log all changes and provide rollback instructions.
Highly sensitive health, medication, wearable, and service-history data could be stored or reused across workflows more broadly than the user expects.
The skill directs automatic creation and updating of persistent health dossiers. The provided execution rules do not clearly define consent, minimization, retention, deletion, access controls, or limits on reuse across later tasks.
C8-10 健康档案维护更新 ... 输出: 更新后的健康档案（时间线版本、变更摘要、当前状态快照） ... AI自动整合数据更新档案
Make health-record persistence opt-in, minimize stored fields, define retention/deletion rules, separate medical data from marketing/community workflows, and run the privacy-compliance workflow before processing real records.
Incorrect safety rules could affect diet, fasting, exercise, and overall intervention approvals across the system.
A fully automatic safety-redline list feeds multiple downstream safety reviews. Bad, incomplete, or poisoned input could propagate through many intervention decisions without a mandatory professional approval gate.
C6-22 安全红线清单维护 ... AI自治度: ⬛ 全自动 — AI自动汇总不良反应数据和指南更新，维护红线清单 ... 组合接口: →C6-06 →C6-07 →C6-08 →C6-18
Require expert review before versioning safety redlines, record source provenance, test changes against known cases, and keep rollback/version controls for safety-rule updates.
The agent may be expected to process ongoing wearable or home-health data, which can feel like continuous monitoring if not clearly opted in.
The skill contemplates real-time monitoring and alerting. This is purpose-aligned for health management, but the artifacts do not define start/stop controls, notification rules, or background-operation limits.
C8-09 远程监测与预警 ... 可穿戴设备数据、家庭检测数据 ... AI实时监测和预警触发，人工处理紧急事件
Use explicit opt-in monitoring sessions, define when monitoring starts and stops, document escalation rules, and avoid background collection unless the user has clearly authorized it.