clinic-research-design
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of local scripts, including
scripts/main.pyandscripts/calculators/sample_size.py, to perform protocol logic selection and deterministic calculations based on user input parameters. - [INDIRECT_PROMPT_INJECTION]: The skill operates as a multi-step logic engine where untrusted user inputs (PICO elements: Patient, Intervention, Comparison, and Outcome) are interpolated into a 'Structured Prompt / Writing Guide' for other LLMs. This creates a vulnerability surface where malicious input could influence the behavior of the agent following the generated instructions.
- Ingestion points: User data enters the context through command-line arguments
--P,--I,--C,--O, and--study_designas documented inSKILL.md. - Boundary markers: The documentation does not specify the use of delimiters (e.g., XML tags or triple quotes) or explicit 'ignore instructions' warnings when interpolating user-provided PICO data into the
[LLM Instruction]blocks. - Capability inventory: The skill possesses the capability to execute local scripts and generate persistent markdown files (
output/protocol.md) that serve as directives for subsequent agent actions. - Sanitization: While the skill includes general input validation to ensure required fields are present, there is no evidence of sanitization or escaping for the user-provided strings to prevent them from being interpreted as instructions by the downstream LLM.
Audit Metadata