ECG-AI-Diagnosis

This skill is internally consistent: it reads a local ECG JSON file and sends that data (and only that data) to heartvoice's cloud API using the HEARTVOICE_API_KEY. Before installing or using it: - Treat ECG JSON as sensitive health data (PHI). Obtain patient consent and follow applicable laws (HIPAA, GDPR, local medical regulation). - Verify the vendor (https://www.heartvoice.com.cn/aiCloud), review their privacy/processing policies, and confirm TLS endpoints and data retention policies. - Keep HEARTVOICE_API_KEY secret (use env vars, do not paste into chat). Rotate and scope the key if the vendor supports it. - Test first with synthetic or anonymized example data rather than real patient data. - Limit file sizes and confirm the 5 MB client-side check is acceptable for your devices; review any additional logging/telemetry you may have in your environment. - If you require on-prem or non-cloud processing for compliance, do not use this skill. Confidence is high that the package does what it claims; the primary residual risk is privacy/regulatory (sensitive data sent to an external cloud), not covert or unrelated code behavior.