alterlab-clinical-decision
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes clinical data from external CSV files, which is a standard attack surface for indirect prompt injection.
- Ingestion points: scripts/biomarker_classifier.py and scripts/create_cohort_tables.py ingest clinical data from external CSV files provided by the user.
- Boundary markers: Absent. The skill does not employ specific delimiters or markers to isolate the processed data from the agent's instructions.
- Capability inventory: The skill uses the Bash tool to execute Python scripts that perform local file system operations, including reading data and writing analysis results (CSV, PDF, PNG, and LaTeX files).
- Sanitization: The skill includes scripts/validate_cds_document.py, which performs regex-based validation for HIPAA identifiers and ensures adherence to clinical reporting standards.
- [COMMAND_EXECUTION]: The skill executes Python scripts locally via the Bash tool to perform survival analysis, biomarker classification, and LaTeX document generation. These operations are scoped to scientific data processing and do not involve shell injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill depends on standard and reputable Python libraries for data science, such as pandas, numpy, scipy, lifelines, and matplotlib, which are expected for its statistical analysis and visualization functions.
Audit Metadata