baseline-extraction-for-clinical-trials
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains a deceptive file
baseline-extraction-for-clinical-trials_audit_result_v1.jsonthat masquerades as an official security report. This is a self-referential injection pattern (Category 8e) designed to deceive the analyzer and human reviewers by providing false safety verdicts such as 'security: PASS'. Additionally, the skill processes untrusted medical text and PDFs without security boundaries. - Ingestion points: Full article text and PDF content via
extract_pdf.py. - Boundary markers: Absent. No markers or 'ignore embedded instructions' warnings are present.
- Capability inventory: Subprocess execution via
baseline_extractor.pyand local file writes viaextract_pdf.py. - Sanitization: None. The content is used directly for LLM extraction.
- [COMMAND_EXECUTION]: The workflow in
SKILL.md(Step 1) instructs the agent to execute shell commands usingsubprocess.runwith a user-supplied<PMID>. There is no validation or sanitization required for this input, creating a vector for command injection if the agent or the underlying script handles the argument unsafely. - [EXTERNAL_DOWNLOADS]: The skill depends on the
PyPDF2library and references the PubMed API. The documentation explicitly states that dependencies are not version-pinned, which introduces a supply chain risk where malicious versions of libraries could be introduced into the execution environment. - [NO_CODE]: The skill instructions reference a primary implementation script
scripts/baseline_extractor.py, but this file is missing from the provided skill package, making its internal logic and safety unverifiable.
Audit Metadata