메뉴
Find logger / print / structlog calls in backend/app/ that reference PHI field names. Use when the user says "run /phi-log-scan", worries a new log line might leak PHI, or is reviewing a CI failure about PHI in stdout. Intentional AuditService calls are excluded.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | phi-log-scan |
| description | Find logger / print / structlog calls in backend/app/ that reference PHI field names. Use when the user says "run /phi-log-scan", worries a new log line might leak PHI, or is reviewing a CI failure about PHI in stdout. Intentional AuditService calls are excluded. |
| tools | ["Read","Bash","Glob"] |
Enforces CLAUDE.md guardrail #5: "PHI never enters stdout."
Walks every .py file under backend/app/ and, for each call
expression, checks whether its printable arguments (f-strings, format
strings, .format(...), %-style) reference PHI field names. Calls on
AuditService (or any audit.*) are intentional and skipped — those
are the sanctioned PHI path.
python .claude/skills/phi-log-scan/check.py
patient_name, first_name, last_name, email, phone, dob,
diagnosis, ssn, mrn, transcript, note_body, address.
Any call whose invocation name matches:
logger.<level>, log.<level>, logging.<level>structlog.*print(...)<level> is any of: debug, info, warning, warn, error,
critical, exception.
audit (audit.log_event(...),
self._audit.log_*(...))backend/tests/ and backend/app/services/audit_service.py
(the audit machinery itself)For each finding: file:line call suggested fix — typical fix is to
drop the PHI token and reference the resource by ID instead, e.g.:
logger.info("patient_name=%s", patient.name)
# →
logger.info("patient_id=%s", patient.id)
Exit code 1 if any findings, 0 otherwise.
Scan route handlers for PHI-touching routes that don't inject or call AuditService. Use when the user asks to audit the HIPAA audit-logging guardrail, says "run /audit-coverage-check", or adds new routes under /patients, /sessions, /appointments, /notes, /transcript, /audio, /soap, /resolve-client, /import-clients.
Weekly human-in-the-loop review of the latest automated pentest report. Pulls the newest report from pablohealth-oss GCS, summarizes findings, offers to open it, then publishes to docs/pentest/ and pablo-marketing/public/security.html via PR. Use when the user says "run /review-pentest", asks to review this week's pentest, or wants to publish the latest pentest report.
Run the owner-authorized weekly pentest on the deployed Pablo app (Cloud Run + Firebase + Cloud SQL). Use when the user asks for a pentest, security test, HIPAA review of the live deployment, or says "run /pentest".
Verify that every RLS-forced tenant table (any table with user_id, patient_id, or id column that is not in not_row_scoped) is covered by the RLS invariant suite and that no tenant table would be left unclassified (deny-all) by enable_rls_on_schema. Use when the user says "rls coverage", adds or alters a table in backend/app/db/models.py, asks about "has_patient_access" enforcement or the "fail-closed registry", or wants to check "new tenant table" safety before pushing.
Run the owner-authorized weekly pentest on the deployed Pablo app (Cloud Run + Firebase + Cloud SQL). Use when the user asks for a pentest, security test, HIPAA review of the live deployment, or says "run /pentest".
Verify every SQLAlchemy model change ships with a matching Alembic migration in the same commit. Use when the user says "run /migration-lint", is about to push a change to backend/app/db/models.py or platform_models.py, or asks why CI is complaining about model drift.