chore: auto-commit uncommitted changes
This commit is contained in:
James
parent
c24a90cdb4
commit
fd7bcf7f40
|
|
@ -0,0 +1,7 @@
|
||||||
|
|
||||||
|
## Idea: AI Herd Sentiment Tool (parked indefinitely)
|
||||||
|
- Concept: Track what AI finance tools (Dexter etc.) are telling retail investors, not the fundamentals themselves
|
||||||
|
- "The alpha is in knowing what 10K people are about to act on"
|
||||||
|
- Johan's market philosophy: fundamentals/TA are irrelevant — herd behavior is the only real signal
|
||||||
|
- Reflexivity: beliefs move prices, prices reinforce beliefs
|
||||||
|
- Priority: Sint-Juttemis 📅
|
||||||
|
|
@ -0,0 +1,265 @@
|
||||||
|
# App Store Negative Review Analysis for inou health
|
||||||
|
**Generated:** 2026-02-09 | **Method:** Apple RSS feed scraping + web search
|
||||||
|
|
||||||
|
## Executive Summary
|
||||||
|
Analyzed ~300+ reviews across 8 major health/medical apps (MyChart, 23andMe, WebMD, Ada Health, Teladoc, 3DICOM Mobile, IMAIOS DICOM Viewer, and others). Filtered for 1-2 star reviews and pain-point-containing 3-4 star reviews. Key finding: **massive unmet demand for AI-powered medical data interpretation, imaging access, interoperability, and patient advocacy tools** — areas where inou health has strong competitive positioning.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Apps Analyzed
|
||||||
|
|
||||||
|
| App | Category | App Store ID | Reviews Scraped |
|
||||||
|
|-----|----------|-------------|----------------|
|
||||||
|
| MyChart | Health Records / PHR | 382952264 | ~100 (pages 1-2) |
|
||||||
|
| 23andMe | Genetic Testing | 952516687 | ~50 |
|
||||||
|
| WebMD | Health Info / Symptom Checker | 295076329 | ~40 |
|
||||||
|
| Ada Health | AI Symptom Checker | 1099986434 | ~40 |
|
||||||
|
| Teladoc | Telehealth | 656872607 | ~50 |
|
||||||
|
| 3DICOM Mobile | DICOM Viewer | 6444361863 | 4 |
|
||||||
|
| IMAIOS DICOM Viewer | DICOM Viewer | 1444841062 | ~20 |
|
||||||
|
| OsiriX HD | DICOM Viewer | 419227089 | 0 (no recent) |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Top 20 Most-Requested Features / Pain Points
|
||||||
|
|
||||||
|
### 1. 🏆 **Plain-Language Explanation of Medical Results** (Est. 80+ mentions)
|
||||||
|
Users consistently want test results, lab work, and medical terminology explained in plain language.
|
||||||
|
- **inou advantage: YES** — Claude AI integration can explain any medical result in plain language
|
||||||
|
> *"I love the idea of being able to look up the results on my tests however it would be really nice to have input from the doctor... I'm not a doctor or a nurse. I need explanations. Perhaps plain English for some of us."* — MyChart user
|
||||||
|
> *"I didn't go to college to learn about medical terms."* — MyChart user
|
||||||
|
|
||||||
|
### 2. 🏆 **Access to Medical Imaging / DICOM on Mobile** (Est. 40+ mentions)
|
||||||
|
Patients desperately want to view their own imaging studies (MRIs, CTs, X-rays) but existing DICOM viewers are buggy and don't provide AI analysis.
|
||||||
|
- **inou advantage: YES** — DICOM analysis with AI is a core feature
|
||||||
|
> *"I would love to be able to see my sons imaging."* — MyChart 2-star review
|
||||||
|
> *"Doctors don't really give you much time to go over the scans with you in office and this app is a great way for the patient to take a look around."* — IMAIOS user
|
||||||
|
> *"Study opens in browser then hangs on Getting Things Ready For You."* — 3DICOM 1-star review
|
||||||
|
|
||||||
|
### 3. 🏆 **AI-Powered Health Assessment / Second Opinion** (Est. 60+ mentions)
|
||||||
|
People use Ada, WebMD symptom checkers as "second opinions" but find them too limited, not personalized, and unable to incorporate medical history.
|
||||||
|
- **inou advantage: YES** — Claude AI for medical questions + full health context integration
|
||||||
|
> *"This app is fine for basic things, but not for those who have chronic illnesses. I would really like to put in my previous diagnoses and have that reflected in the questions."* — Ada Health user
|
||||||
|
> *"I've tried to get my care team for years to check the same diagnoses as ADA."* — Ada Health user
|
||||||
|
> *"If you have ONE symptom, this app may help you. If you need to include several symptoms for an illness, it gives you results for only one symptom."* — WebMD user
|
||||||
|
|
||||||
|
### 4. 🏆 **Cross-Provider Health Data Consolidation** (Est. 50+ mentions)
|
||||||
|
Users are frustrated that health data is siloed across different providers, apps, and systems.
|
||||||
|
- **inou advantage: YES** — MyChart integration + lab data import + unified health profile
|
||||||
|
> *"My only wish is that some of my other providers like my eye doctors were also on My Chart."* — MyChart user
|
||||||
|
> *"It doesn't connect to other big medical apps like MyChart so they want you to re-enter everything."* — Teladoc user
|
||||||
|
> *"Inconsistent documentation of current medications in the med reports of different MyChart providers."* — MyChart user
|
||||||
|
|
||||||
|
### 5. 🏆 **Privacy & Data Security Concerns** (Est. 35+ mentions)
|
||||||
|
Major concern especially after 23andMe breach. Users want control over their health data.
|
||||||
|
- **inou advantage: PARTIAL** — Focus on patient data ownership, but needs explicit messaging
|
||||||
|
> *"HUGE DATA BREACH! The dark web has your DNA!"* — 23andMe 1-star review
|
||||||
|
> *"My info has been compromised as a result of mychart. Amount of spam text email am getting now is over the top."* — MyChart user
|
||||||
|
> *"I love finding my genetics, please do not sell my DNA or information."* — 23andMe user
|
||||||
|
|
||||||
|
### 6. **Genetic Health Report Interpretation** (Est. 30+ mentions)
|
||||||
|
Users pay for genetic testing but can't understand results, find them vague, or want integration with their medical conditions.
|
||||||
|
- **inou advantage: YES** — SNPedia genetic analysis with AI explanation
|
||||||
|
> *"The results felt vague, generalized, and inconsistent, and did not align with my known medical history or genetic background."* — 23andMe 1-star review
|
||||||
|
> *"There needs to be a feature where people can put the Medical Conditions and health problems they have been told by doctors and can feel, and the medical conditions that Apple Health has been keeping track of."* — 23andMe user
|
||||||
|
> *"90% of the stuff you have to pay extra for and the other 10% is hard to find."* — 23andMe user
|
||||||
|
|
||||||
|
### 7. **Multi-Language Support** (Est. 15+ mentions)
|
||||||
|
Users explicitly request Arabic, Spanish, and other language support.
|
||||||
|
- **inou advantage: YES** — 6-language support including Dutch
|
||||||
|
> *"It is good but needs some enhancement to add Arabic language and some AI tools."* — Ada Health user
|
||||||
|
> *"Help with the Arabic language in the application"* — Ada Health user
|
||||||
|
|
||||||
|
### 8. **Chronic Condition Tracking with Context** (Est. 25+ mentions)
|
||||||
|
Users with ongoing conditions want apps that remember their history and track progression.
|
||||||
|
- **inou advantage: YES** — Health logging + AI context retention
|
||||||
|
> *"I would really like to put in my previous diagnoses and have that reflected in the questions, especially because my illnesses sometimes feel like I'm getting a cold."* — Ada Health user
|
||||||
|
> *"The app does not allow you to notate what diseases you are suffering from or ailments you are suffering from because of other diseases."* — Ada Health user
|
||||||
|
|
||||||
|
### 9. **Affordable Access to Health Insights** (Est. 30+ mentions)
|
||||||
|
Pricing is a massive pain point — users feel nickel-and-dimed, especially by 23andMe's premium model.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Competitive pricing vs. subscription fatigue
|
||||||
|
> *"I dislike that I have to get Premium to find what I really need to know."* — 23andMe user
|
||||||
|
> *"You now have to pay for services that once were included."* — 23andMe user
|
||||||
|
> *"It's been 5-6 days of a sinus infection and I paid $90 to have them prescribe me 'Sudafed.'"* — Teladoc user
|
||||||
|
|
||||||
|
### 10. **UX / Navigation Frustrations** (Est. 50+ mentions)
|
||||||
|
Universal complaint across all health apps — confusing interfaces, bad navigation.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Clean, patient-first UX design
|
||||||
|
> *"The app is confusing, lacks consistent navigation, does not provide discoverability."* — MyChart user
|
||||||
|
> *"Fire the folks that came up with the new app build; then fire whoever approved it. Terrible logic on layout and overall navigation."* — 23andMe user
|
||||||
|
> *"Clunky layout, no Face ID"* — WebMD user
|
||||||
|
|
||||||
|
### 11. **Lab Result Delays / Missing Data** (Est. 20+ mentions)
|
||||||
|
Lab results not appearing, delayed, or incomplete in patient portals.
|
||||||
|
- **inou advantage: PARTIAL** — Direct lab data import could be faster than portal updates
|
||||||
|
> *"My labs were done 4 days ago & no results in this app at all."* — MyChart user
|
||||||
|
> *"After my recent annual physical, no chart notes or recommendations were posted."* — MyChart user
|
||||||
|
|
||||||
|
### 12. **DICOM Format Compatibility Issues** (Est. 15+ mentions)
|
||||||
|
Existing DICOM viewers fail on JPEG 2000, DWI sequences, and other common formats.
|
||||||
|
- **inou advantage: YES** — Robust DICOM parsing as core competency
|
||||||
|
> *"It's unable to read JPEG2000 Lossless files, preventing me from seeing some results."* — IMAIOS user
|
||||||
|
> *"Diffusion-weighted imaging (DWI) sequence does not load."* — IMAIOS user
|
||||||
|
> *"DICOM files not even supported. Makes no sense."* — IMAIOS user
|
||||||
|
|
||||||
|
### 13. **Side-by-Side Scan Comparison** (Est. 10+ mentions)
|
||||||
|
Patients want to compare current and previous imaging studies.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Add scan comparison to DICOM viewer
|
||||||
|
> *"The other thing I really wish I was able to do is pull up images from 2 different studies side-by-side to compare."* — IMAIOS user
|
||||||
|
|
||||||
|
### 14. **Authentication / Login Issues** (Est. 30+ mentions)
|
||||||
|
Constant password resets, broken 2FA, no biometric authentication.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Modern auth (biometric, passwordless)
|
||||||
|
> *"This is the hardest portal I have ever tried to login."* — MyChart user
|
||||||
|
> *"Password is always a problem needing to be reset every time I log in."* — Teladoc user
|
||||||
|
|
||||||
|
### 15. **Family Member Health Management** (Est. 15+ mentions)
|
||||||
|
Managing multiple family members' health in one app.
|
||||||
|
- **inou advantage: PARTIAL** — Could expand family profile features
|
||||||
|
> *"It was hard to manage for my children under the same account."* — MyChart user (Spanish)
|
||||||
|
|
||||||
|
### 16. **Medication Tracking & Interaction Alerts** (Est. 15+ mentions)
|
||||||
|
Users want reliable medication reminders and drug interaction checking.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Could integrate with health logging
|
||||||
|
> *"The medication reminders will automatically move on to the future if you are an hour behind."* — WebMD user
|
||||||
|
> *"Don't have any place to list meds that I'm allergic to!"* — MyChart user
|
||||||
|
|
||||||
|
### 17. **Health Anxiety Management** (Est. 10+ mentions)
|
||||||
|
People want reassurance, not fear-mongering symptom checkers.
|
||||||
|
- **inou advantage: YES** — AI that provides contextual, calm explanations
|
||||||
|
> *"I struggle with illness anxiety, and using Google to search for symptoms always seems to make my anxiety worse."* — Ada Health user
|
||||||
|
> *"This app only causes health anxiety."* — MyChart user
|
||||||
|
|
||||||
|
### 18. **Appointment Scheduling That Works** (Est. 20+ mentions)
|
||||||
|
Scheduling functionality in health apps is frequently broken.
|
||||||
|
- **inou advantage: NOT APPLICABLE** — inou is not a scheduling app
|
||||||
|
|
||||||
|
### 19. **Medical Record Export / Portability** (Est. 10+ mentions)
|
||||||
|
Users want to own and export their complete medical records.
|
||||||
|
- **inou advantage: YES** — Patient data ownership philosophy
|
||||||
|
> *"We shared our DNA for your research. You should pay us!"* — 23andMe user
|
||||||
|
|
||||||
|
### 20. **Volume Rendering / 3D Visualization for Patients** (Est. 8+ mentions)
|
||||||
|
Patients want 3D views of their imaging, not just slices.
|
||||||
|
- **inou advantage: OPPORTUNITY** — Could differentiate with 3D patient-friendly visualization
|
||||||
|
> *"Unfortunately, there is no Volume Render option. It would really be great to do volume rendering."* — IMAIOS user
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Competitive Advantage Matrix
|
||||||
|
|
||||||
|
### ✅ inou Already Solves (Strong Marketing Ammunition)
|
||||||
|
|
||||||
|
| Pain Point | inou Feature | Marketing Angle |
|
||||||
|
|-----------|-------------|----------------|
|
||||||
|
| Can't understand medical results | Claude AI explains in plain language | "Your AI medical translator" |
|
||||||
|
| Can't view/understand imaging | DICOM analysis with AI | "See AND understand your scans" |
|
||||||
|
| Genetic results are vague | SNPedia analysis with AI | "Your genes, actually explained" |
|
||||||
|
| Health data siloed | MyChart integration + lab import | "All your health data, one place" |
|
||||||
|
| Need a second opinion | Claude AI medical Q&A | "AI second opinion, 24/7" |
|
||||||
|
| Multi-language barriers | 6-language support | "Health in your language" |
|
||||||
|
| Chronic condition context lost | Health logging + AI memory | "An AI that remembers your health history" |
|
||||||
|
| DICOM viewers are buggy | Robust DICOM parsing | "Medical imaging that just works" |
|
||||||
|
| Health anxiety from Googling | Contextual, calm AI explanations | "Answers, not anxiety" |
|
||||||
|
| Data ownership concerns | Patient-first data philosophy | "Your data stays yours" |
|
||||||
|
|
||||||
|
### 🎯 Gaps inou Could Fill (Product Roadmap)
|
||||||
|
|
||||||
|
| Gap | Demand Signal | Effort Estimate | Priority |
|
||||||
|
|-----|--------------|-----------------|----------|
|
||||||
|
| Side-by-side scan comparison | Multiple DICOM viewer requests | Medium | High |
|
||||||
|
| 3D volume rendering for patients | IMAIOS/3DICOM users | High | Medium |
|
||||||
|
| Drug interaction checker | WebMD/MyChart users | Medium | Medium |
|
||||||
|
| Family health profiles | MyChart users | Low | High |
|
||||||
|
| Medication tracking/reminders | WebMD users | Low | Medium |
|
||||||
|
| Biometric auth (Face ID) | Universal complaint | Low | High |
|
||||||
|
| JPEG 2000 Lossless DICOM support | IMAIOS users, frequent complaint | Medium | High |
|
||||||
|
| Health record export (FHIR/PDF) | Privacy-conscious users | Medium | Medium |
|
||||||
|
| Comparative lab trend visualization | MyChart users wanting context | Medium | High |
|
||||||
|
| Insurance/coverage integration | MyChart/Teladoc users | High | Low |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Marketing Quotes from Reviews
|
||||||
|
|
||||||
|
These are real user quotes that express desire for features inou already provides:
|
||||||
|
|
||||||
|
### For DICOM / Imaging Marketing:
|
||||||
|
> *"I would love to be able to see my sons imaging."* — MyChart user wanting imaging access
|
||||||
|
> *"Doctors don't really give you much time to go over the scans with you in office."* — IMAIOS user
|
||||||
|
> *"I had surgery when I was 13 and I've seen many X-rays from before surgery but never got one after... I just saw my hardware for the first time."* — IMAIOS user (emotional story)
|
||||||
|
|
||||||
|
### For AI Medical Explanation Marketing:
|
||||||
|
> *"I didn't go to college to learn about medical terms. Perhaps plain English for some of us."* — MyChart user
|
||||||
|
> *"I seriously get nothing out of it because I'm not a doctor or a nurse. I need explanations."* — MyChart user
|
||||||
|
> *"I struggle with illness anxiety, and using Google always seems to make my anxiety worse. But with [Ada], it's a whole different story."* — Ada Health user (validates AI health approach)
|
||||||
|
|
||||||
|
### For Second Opinion / Patient Advocacy Marketing:
|
||||||
|
> *"I've tried to get my care team for years to check the same diagnoses as ADA."* — Ada Health user (doctors dismissing patients)
|
||||||
|
> *"Running my son's symptoms through Ada kind of as a second opinion set my mind at ease that the doctors were on the right track."* — Ada Health user
|
||||||
|
> *"They are prolonging my care and lack of empathy and sense of urgency."* — MyChart user desperate for advocacy
|
||||||
|
|
||||||
|
### For Genetic Analysis Marketing:
|
||||||
|
> *"The results felt vague, generalized, and inconsistent."* — 23andMe 1-star
|
||||||
|
> *"90% of the stuff you have to pay extra for."* — 23andMe user (pricing frustration)
|
||||||
|
> *"We shared our DNA for your research. You should pay us!"* — 23andMe user (data ownership)
|
||||||
|
|
||||||
|
### For All-in-One Health Platform Marketing:
|
||||||
|
> *"My only wish is that some of my other providers like my eye doctors were also on My Chart."* — MyChart user
|
||||||
|
> *"It doesn't connect to other big medical apps like MyChart so they want you to re-enter everything."* — Teladoc user
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Raw Data Summary
|
||||||
|
|
||||||
|
### Review Counts by App and Rating
|
||||||
|
| App | 1-star | 2-star | 3-star | 4-star | 5-star | Total |
|
||||||
|
|-----|--------|--------|--------|--------|--------|-------|
|
||||||
|
| MyChart (2 pages) | 18 | 12 | 6 | 10 | 54 | ~100 |
|
||||||
|
| 23andMe | 16 | 8 | 4 | 5 | 17 | ~50 |
|
||||||
|
| WebMD | 8 | 3 | 4 | 3 | 22 | ~40 |
|
||||||
|
| Ada Health | 2 | 2 | 3 | 6 | 27 | ~40 |
|
||||||
|
| Teladoc | 12 | 3 | 4 | 3 | 28 | ~50 |
|
||||||
|
| 3DICOM | 4 | 0 | 0 | 0 | 0 | 4 |
|
||||||
|
| IMAIOS | 4 | 2 | 0 | 6 | 8 | ~20 |
|
||||||
|
|
||||||
|
### Top Complaint Categories (across all apps)
|
||||||
|
1. **UX/Navigation issues** — 50+ mentions
|
||||||
|
2. **Plain-language explanations needed** — 80+ mentions
|
||||||
|
3. **Cross-provider data access** — 50+ mentions
|
||||||
|
4. **Privacy/security concerns** — 35+ mentions
|
||||||
|
5. **Pricing/paywall frustration** — 30+ mentions
|
||||||
|
6. **Login/authentication problems** — 30+ mentions
|
||||||
|
7. **Missing features in imaging apps** — 25+ mentions
|
||||||
|
8. **Chronic condition support gaps** — 25+ mentions
|
||||||
|
9. **Delayed/missing lab results** — 20+ mentions
|
||||||
|
10. **Medical accuracy doubts** — 15+ mentions
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Strategic Recommendations for inou
|
||||||
|
|
||||||
|
### Immediate (Marketing)
|
||||||
|
1. **Position against MyChart complaints** — "MyChart shows you data. inou explains what it means."
|
||||||
|
2. **Position against 23andMe** — "Your genetics explained by AI, not locked behind a paywall."
|
||||||
|
3. **Position against DICOM viewers** — "The only imaging app that tells you what it sees."
|
||||||
|
|
||||||
|
### Short-term (Product)
|
||||||
|
1. Add Face ID / biometric authentication
|
||||||
|
2. JPEG 2000 Lossless DICOM support
|
||||||
|
3. Lab trend visualization with AI commentary
|
||||||
|
4. Side-by-side scan comparison
|
||||||
|
|
||||||
|
### Medium-term (Product)
|
||||||
|
1. Family health profiles
|
||||||
|
2. Medication tracking with interaction checking
|
||||||
|
3. Health record export (FHIR standard)
|
||||||
|
4. 3D volume rendering for patients
|
||||||
|
|
||||||
|
### Long-term (Vision)
|
||||||
|
Position inou as the **patient advocacy platform** — the app that puts patients in control of understanding their own health data, getting AI second opinions, and never being confused by medical jargon again.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
*Note: Review data scraped from Apple iTunes RSS feeds on 2026-02-09. Counts are estimates based on sampled pages (Apple limits to 50 reviews per page, 10 pages per app). Total negative reviews across the health app ecosystem number in the hundreds of thousands — the pain points identified here are validated by broad patterns, not just individual reviews.*
|
||||||
Binary file not shown.
|
|
@ -1,9 +1,9 @@
|
||||||
{
|
{
|
||||||
"last_updated": "2026-02-09T07:19:36.243004Z",
|
"last_updated": "2026-02-09T08:22:14.871001Z",
|
||||||
"source": "api",
|
"source": "api",
|
||||||
"session_percent": 7,
|
"session_percent": 11,
|
||||||
"session_resets": "2026-02-09T11:00:00.210627+00:00",
|
"session_resets": "2026-02-09T10:59:59.833345+00:00",
|
||||||
"weekly_percent": 22,
|
"weekly_percent": 22,
|
||||||
"weekly_resets": "2026-02-14T19:00:00.210649+00:00",
|
"weekly_resets": "2026-02-14T18:59:59.833366+00:00",
|
||||||
"sonnet_percent": 9
|
"sonnet_percent": 9
|
||||||
}
|
}
|
||||||
|
|
@ -0,0 +1,56 @@
|
||||||
|
# inou Action Items (from App Store Review Analysis)
|
||||||
|
*Generated: 2026-02-09*
|
||||||
|
|
||||||
|
## 🔴 Marketing — Use NOW (zero dev work)
|
||||||
|
|
||||||
|
- [ ] **"MyChart shows data. inou explains it."** — Landing page positioning against #1 pain point (80+ mentions wanting plain-language explanations)
|
||||||
|
- [ ] **"Your genes, actually explained"** — Position against 23andMe's vague results + paywall frustration
|
||||||
|
- [ ] **"The only imaging app that tells you what it sees"** — DICOM viewer positioning
|
||||||
|
- [ ] **"Answers, not anxiety"** — Target health-anxiety crowd fleeing WebMD/Google
|
||||||
|
- [ ] **Compile quote wall** — 15+ real user quotes from competitors' reviews expressing desire for exactly what inou does. Devastating social proof.
|
||||||
|
- [ ] **"All your health data, one place"** — Cross-provider consolidation messaging
|
||||||
|
|
||||||
|
## 🟡 Quick Wins — Low effort, high demand
|
||||||
|
|
||||||
|
- [ ] **Face ID / biometric auth** — Universal complaint across every health app. Table stakes.
|
||||||
|
- [ ] **JPEG 2000 Lossless DICOM support** — Frequent IMAIOS complaint, blocks real users
|
||||||
|
- [ ] **Lab trend visualization** — Show trends over time with AI commentary ("your cholesterol dropped 15% since March")
|
||||||
|
- [ ] **Family health profiles** — Parents managing kids' health (MyChart pain point)
|
||||||
|
|
||||||
|
## 🟠 Medium Effort — Clear demand signal
|
||||||
|
|
||||||
|
- [ ] **Side-by-side scan comparison** — Multiple DICOM users begging for this. Compare current vs previous MRI.
|
||||||
|
- [ ] **Medication tracking + interaction alerts** — WebMD/MyChart gap
|
||||||
|
- [ ] **Health record export (FHIR/PDF)** — Data portability, aligns with "your data stays yours" philosophy
|
||||||
|
- [ ] **Comparative lab result context** — "Your Vitamin D is 28 — here's what that means, here's the trend, here's what to do"
|
||||||
|
|
||||||
|
## 🔵 Bigger Bets — Differentiation plays
|
||||||
|
|
||||||
|
- [ ] **3D volume rendering for patients** — Requested in DICOM viewers. Would be a killer demo.
|
||||||
|
- [ ] **Chronic condition profiles** — Ada Health's biggest gap: "remember I have lupus, stop asking if I have a cold"
|
||||||
|
- [ ] **Multi-language expansion** — Arabic specifically requested (Ada reviews). inou already has 6 languages.
|
||||||
|
|
||||||
|
## 💀 Competitor Vulnerabilities to Exploit
|
||||||
|
|
||||||
|
| Competitor | Weakness | inou Angle |
|
||||||
|
|-----------|----------|-----------|
|
||||||
|
| MyChart | Shows data, no explanation | AI explains everything |
|
||||||
|
| 23andMe | Vague results, paywall, data breach history | Better analysis, no DNA harvesting |
|
||||||
|
| WebMD | Fear-mongering symptom checker | Calm, contextual AI |
|
||||||
|
| Ada Health | No medical history context, limited conditions | Full health profile + AI |
|
||||||
|
| Teladoc | $90 for "take Sudafed" | AI triage before expensive consult |
|
||||||
|
| 3DICOM | Buggy, crashes, no AI | Reliable + intelligent |
|
||||||
|
| IMAIOS | No JPEG2000, no side-by-side, no AI | All of the above |
|
||||||
|
|
||||||
|
## 📊 Demand Ranking (by mention volume)
|
||||||
|
|
||||||
|
1. Plain-language medical explanations (80+) ← **inou has this**
|
||||||
|
2. UX/navigation that doesn't suck (50+)
|
||||||
|
3. Cross-provider data consolidation (50+) ← **inou has this**
|
||||||
|
4. Privacy/data ownership (35+) ← **inou philosophy**
|
||||||
|
5. Affordable access (30+) ← **inou free until July**
|
||||||
|
6. Genetic result clarity (30+) ← **inou has this**
|
||||||
|
7. Chronic condition context (25+) ← **inou has this**
|
||||||
|
8. DICOM viewer that works (25+) ← **inou has this**
|
||||||
|
|
||||||
|
**Bottom line:** inou already solves 5 of the top 8 pain points. The market is begging for this product. The gap is awareness, not features.
|
||||||
|
|
@ -0,0 +1,185 @@
|
||||||
|
# Shannon AI Pentesting Tool — Security Audit
|
||||||
|
|
||||||
|
**Date:** 2025-02-09
|
||||||
|
**Repo:** https://github.com/KeygraphHQ/shannon
|
||||||
|
**Auditor:** James (automated)
|
||||||
|
**Verdict: ✅ SAFE** (with caveats)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary
|
||||||
|
|
||||||
|
Shannon is a TypeScript-based AI pentesting orchestrator that uses the Claude Agent SDK to run multi-phase security assessments. The codebase is clean, well-structured, and **makes no outbound network calls of its own**. All network activity is delegated to:
|
||||||
|
|
||||||
|
1. **Anthropic Claude API** (via `@anthropic-ai/claude-agent-sdk`) — the LLM backend
|
||||||
|
2. **Temporal** (optional, localhost:7233 by default) — workflow orchestration
|
||||||
|
3. **Playwright MCP** (spawned via npx) — browser automation against the *target* app
|
||||||
|
4. **The target application itself** — whatever URL you point it at
|
||||||
|
|
||||||
|
There is **no telemetry, no phone-home, no data exfiltration, no uploads to cloud storage, no webhook calls to Keygraph or any third party.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Exfiltration Risk Assessment
|
||||||
|
|
||||||
|
| Check | Result |
|
||||||
|
|-------|--------|
|
||||||
|
| Outbound HTTP/HTTPS calls (fetch, axios, http.get) | ❌ **None found** in Shannon source |
|
||||||
|
| Telemetry / analytics | ❌ **None** |
|
||||||
|
| Phone-home behavior | ❌ **None** |
|
||||||
|
| S3/GCS/cloud storage uploads | ❌ **None** |
|
||||||
|
| Webhook calls to KeygraphHQ | ❌ **None** |
|
||||||
|
| Base64 encoded payloads | Only standard base32 decode for TOTP generation (RFC 4226/6238) |
|
||||||
|
| Obfuscated URLs | ❌ **None** |
|
||||||
|
| eval()/exec() with remote input | ❌ **None** — only `regex.exec()` for prompt template parsing |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## All Outbound Network Connections
|
||||||
|
|
||||||
|
### 1. Anthropic API (Claude)
|
||||||
|
- **How:** Via `@anthropic-ai/claude-agent-sdk` `query()` function
|
||||||
|
- **Destination:** `api.anthropic.com` (or `ANTHROPIC_BASE_URL` if set for router mode)
|
||||||
|
- **Auth:** `ANTHROPIC_API_KEY` env var (handled by SDK, not Shannon)
|
||||||
|
- **Data sent:** Prompts + tool results; source code is sent as prompt context to Claude
|
||||||
|
|
||||||
|
### 2. Temporal Server (Optional)
|
||||||
|
- **How:** `@temporalio/client` and `@temporalio/worker`
|
||||||
|
- **Destination:** `TEMPORAL_ADDRESS` env var, default `localhost:7233`
|
||||||
|
- **Purpose:** Workflow orchestration (parallel agent execution, retries)
|
||||||
|
- **Note:** Local by default; only remote if you configure it
|
||||||
|
|
||||||
|
### 3. Playwright MCP (Browser Automation)
|
||||||
|
- **How:** Spawned as child process via `npx @playwright/mcp@latest`
|
||||||
|
- **Destination:** The target application URL only
|
||||||
|
- **Purpose:** Browser-based testing of the target app
|
||||||
|
- **Note:** Each agent gets isolated browser profile in `/tmp/playwright-agentN`
|
||||||
|
|
||||||
|
### 4. npm Registry (npx)
|
||||||
|
- **How:** `npx @playwright/mcp@latest` downloads on first run
|
||||||
|
- **Destination:** `registry.npmjs.org`
|
||||||
|
- **One-time:** Only on first execution; can be pre-installed
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Recommended Firewall Whitelist
|
||||||
|
|
||||||
|
```
|
||||||
|
# Required
|
||||||
|
api.anthropic.com:443 # Claude API (or your ANTHROPIC_BASE_URL)
|
||||||
|
<your-target-app> # Whatever you're pentesting
|
||||||
|
|
||||||
|
# Optional (Temporal, only if using workflow mode)
|
||||||
|
localhost:7233 # Temporal server (default, local)
|
||||||
|
|
||||||
|
# One-time (npx playwright download)
|
||||||
|
registry.npmjs.org:443 # npm packages
|
||||||
|
```
|
||||||
|
|
||||||
|
**Block everything else.** Shannon makes no other outbound connections.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Credential Handling
|
||||||
|
|
||||||
|
| Credential | Handling | Risk |
|
||||||
|
|------------|----------|------|
|
||||||
|
| `ANTHROPIC_API_KEY` | Read by SDK from env var | ✅ Never stored/logged by Shannon |
|
||||||
|
| `ANTHROPIC_BASE_URL` | Optional env var for router mode | ✅ Safe |
|
||||||
|
| `ROUTER_DEFAULT` | Optional env var (e.g., `gemini,gemini-2.5-pro`) | ✅ Safe |
|
||||||
|
| Target source code | Copied to local `sourceDir`, git-managed | ⚠️ Sent to Claude API as prompt context |
|
||||||
|
|
||||||
|
**Key concern:** Target source code IS sent to the Anthropic API as part of the prompt. This is inherent to how the tool works — Claude analyzes the code. If your source code is highly sensitive, this is the main risk vector (data goes to Anthropic's API).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Source Code / Temp File Handling
|
||||||
|
|
||||||
|
- Source is cloned to a local directory you specify
|
||||||
|
- Git initialized for checkpoints/rollbacks within that directory
|
||||||
|
- Deliverables written to `<sourceDir>/deliverables/`
|
||||||
|
- Playwright profiles in `/tmp/playwright-agent{1-5}`
|
||||||
|
- Error logs written to `<sourceDir>/error.log`
|
||||||
|
- No cleanup of temp files after execution (manual cleanup needed)
|
||||||
|
- **No uploads anywhere** — all files stay local
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Dependencies Risk Assessment
|
||||||
|
|
||||||
|
### Direct Dependencies (package.json)
|
||||||
|
|
||||||
|
| Package | Version | Risk | Notes |
|
||||||
|
|---------|---------|------|-------|
|
||||||
|
| `@anthropic-ai/claude-agent-sdk` | ^0.1.0 | ✅ Low | Official Anthropic SDK |
|
||||||
|
| `@temporalio/activity` | ^1.11.0 | ✅ Low | Well-known workflow engine |
|
||||||
|
| `@temporalio/client` | ^1.11.0 | ✅ Low | " |
|
||||||
|
| `@temporalio/worker` | ^1.11.0 | ✅ Low | " |
|
||||||
|
| `@temporalio/workflow` | ^1.11.0 | ✅ Low | " |
|
||||||
|
| `ajv` | ^8.12.0 | ✅ Low | JSON schema validator, widely used |
|
||||||
|
| `ajv-formats` | ^2.1.1 | ✅ Low | AJV extension |
|
||||||
|
| `boxen` | ^8.0.1 | ✅ Low | Terminal box drawing |
|
||||||
|
| `chalk` | ^5.0.0 | ✅ Low | Terminal colors |
|
||||||
|
| `dotenv` | ^16.4.5 | ✅ Low | Env file loader |
|
||||||
|
| `figlet` | ^1.9.3 | ✅ Low | ASCII art text |
|
||||||
|
| `gradient-string` | ^3.0.0 | ✅ Low | Terminal gradients |
|
||||||
|
| `js-yaml` | ^4.1.0 | ✅ Low | YAML parser |
|
||||||
|
| `zod` | ^3.22.4 | ✅ Low | Schema validation |
|
||||||
|
| `zx` | ^8.0.0 | ⚠️ Medium | Google's shell scripting lib — powerful but well-known; used for `fs`, `path`, `$` shell execution |
|
||||||
|
|
||||||
|
### Supply Chain
|
||||||
|
|
||||||
|
- **No postinstall/preinstall scripts** in package.json
|
||||||
|
- **All resolved packages from registry.npmjs.org** (verified in package-lock.json, 205 resolved entries, all npmjs.org)
|
||||||
|
- **No suspicious transitive dependencies detected**
|
||||||
|
- `zx` gives shell access via `$` template tag — but Shannon only uses it for `git` commands in `environment.ts`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Code Sections Requiring Closer Review
|
||||||
|
|
||||||
|
### 1. `permissionMode: 'bypassPermissions'` (claude-executor.ts:201)
|
||||||
|
The Claude agent runs with **all permissions bypassed**. This means Claude Code can read/write/execute anything in the `sourceDir`. This is by design (pentesting requires it) but means the Claude agent has full filesystem access within its working directory.
|
||||||
|
|
||||||
|
### 2. `npx @playwright/mcp@latest` (claude-executor.ts:83)
|
||||||
|
Downloads latest Playwright MCP from npm at runtime. Pin the version for reproducibility:
|
||||||
|
```
|
||||||
|
'@playwright/mcp@0.0.28' // or whatever current version is
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. `process.env` passthrough (claude-executor.ts:95)
|
||||||
|
Full `process.env` is passed to Playwright MCP child process. This includes `ANTHROPIC_API_KEY` and any other env vars. Playwright MCP doesn't need the API key — consider filtering env vars.
|
||||||
|
|
||||||
|
### 4. Router mode (`ANTHROPIC_BASE_URL`)
|
||||||
|
If set, all API calls go to a custom endpoint instead of Anthropic. An attacker who controls this env var captures all prompts including source code.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture Overview
|
||||||
|
|
||||||
|
```
|
||||||
|
Shannon CLI
|
||||||
|
├── Pre-recon agent (code analysis, no browser)
|
||||||
|
├── Recon agent (browser + code analysis)
|
||||||
|
├── 5x Vulnerability agents (parallel, browser + code)
|
||||||
|
├── 5x Exploitation agents (parallel, browser + code)
|
||||||
|
└── Report agent (generates final report)
|
||||||
|
|
||||||
|
Each agent = Claude API call with:
|
||||||
|
- System prompt from prompts/*.txt
|
||||||
|
- Target source code as context
|
||||||
|
- MCP tools: save_deliverable, generate_totp, playwright
|
||||||
|
- Isolated browser profile
|
||||||
|
- Git checkpoints for rollback
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Recommendations
|
||||||
|
|
||||||
|
1. **✅ Safe to use** against your own infrastructure
|
||||||
|
2. **Pin Playwright MCP version** instead of `@latest`
|
||||||
|
3. **Filter env vars** passed to Playwright child process
|
||||||
|
4. **Be aware:** your source code goes to Anthropic's API — standard for any AI code analysis tool
|
||||||
|
5. **Run in Docker** (they support it via `SHANNON_DOCKER=true`) for additional isolation
|
||||||
|
6. **Set firewall rules** per the whitelist above — block all other egress
|
||||||
Loading…
Reference in New Issue