clinical-note-extract-skill
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- Isolated Extraction Environment: The skill employs a 'note-extract-worker' subagent that is explicitly configured with no tools. This architectural choice ensures that the untrusted clinical note text, which might contain indirect prompt injections, structurally cannot reach tools that perform network or file system operations.
- Boundary Sanitization and Injection Mitigation: In
workflows/extract-batch.js, the skill sanitizes the clinical note text by neutralizing potential XML breakout attempts (e.g., replacing</NOTEwith<\/NOTE). This prevents malicious text within a note from attempting to override instructions or escape the data container. - Strict Output Schema Enforcement: The workflow uses a JSON schema with
additionalProperties: falseto constrain the model's output. This prevents the extraction model from returning unexpected keys or metadata that could be used for data smuggling or prompt injection attacks. - Proactive Tool Disabling in CLI: The
scripts/batch.tsutility uses the--disallowed-tools "*"flag when spawning sub-processes. This represents a proactive application of the principle of least privilege, ensuring the batch environment remains restricted even when scaled. - Local Data Handling Guidance: The skill provides clear instructions on handling Protected Health Information (PHI), advising users to treat the local run directory as temporary storage and avoiding unauthorized copying to shared storage, which aligns with data privacy best practices.
Audit Metadata