check-reporting
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts included in the repository. These scripts (e.g., check_checklist_exists.py, prisma_cascade_check.py) perform text analysis and arithmetic verification using standard libraries only. This is an intended and safe use of the platform's capabilities for structured logic.
- [DATA_EXPOSURE]: The skill documentation mentions references to a path like
~/.claude/rules/, but explicitly clarifies that these are documentation artifacts for maintainer conventions and are not shipped with the skill or accessible during runtime. No attempts to read sensitive files (SSH keys, AWS creds) were found. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data in the form of medical manuscripts. While this presents a standard attack surface, the risk is mitigated by the skill's specific audit procedures and the use of deterministic scripts for sensitive checks like numerical reporting and framework naming. This is consistent with the skill's primary purpose.
- [NO_CODE]: All functional code is provided as local Python scripts within the skill's subdirectory. No remote dependencies, external package installations, or obfuscated payloads are present.
Audit Metadata