Is kaichop/phenoskill safe?
Yes. kaichop/phenoskill is safe to install. Oathe's behavioral security audit gave the phenoskill skill by kaichop a trust score of 80/100 with 5 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/kaichop/phenoskill
Is kaichop/phenoskill safe to install?
This skill provides legitimate medical phenotype extraction functionality but introduces supply chain risks by downloading and executing external Python code from GitHub. While the stated purpose is valid and includes privacy safeguards, the reliance on external dependencies creates potential attack vectors.
What security issues were found in kaichop/phenoskill?
Category Scores
Findings (5)
HIGH Downloads and executes external code -25 ▶
The skill downloads PhenoSnap from GitHub and executes arbitrary Python code. This creates a supply chain attack vector if the external repository is compromised.
MEDIUM Installs arbitrary Python packages -15 ▶
The skill runs 'pip install -r requirements.txt' which installs dependencies from PyPI without verification, creating additional supply chain risks.
MEDIUM Network dependencies despite local-only claims -20 ▶
While claiming to be local-only, the skill requires network access to download PhenoSnap and get-pip.py during setup.
LOW Processes sensitive medical data -10 ▶
The skill processes potentially sensitive clinical phenotype and medication information, though it includes redaction safeguards.
INFO Legitimate medical research purpose 0 ▶
The skill serves a valid use case for medical phenotype extraction and includes appropriate privacy protections.
Should I install kaichop/phenoskill?
Oathe's verdict for kaichop/phenoskill is SAFE with a trust score of 80/100. Recommendation: Install with caution.