sesion-mental-health-orchestration
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct users to clone and install a project from an unverified third-party GitHub repository (
github.com/fahad-hamid/psique-workflow-clinic.git) which does not align with the stated author's identity or official vendor resources. - [PROMPT_INJECTION]: The skill architecture presents a surface for indirect prompt injection by processing untrusted data via LLM prompts.
- Ingestion points: The skill ingests untrusted text from incoming WhatsApp messages in
src/whatsapp/whatsapp.service.tsand raw clinician notes insrc/ai/claude.service.ts. - Boundary markers: The prompts (e.g., in
assistNoteGenerationandgenerateClinicalSummary) interpolate user-provided strings directly into the prompt context without the use of delimiters, XML tags, or system instructions to ignore control characters or embedded commands. - Capability inventory: The skill has access to perform database operations (via Prisma ORM) and network operations (sending automated WhatsApp messages via Baileys and invoking the Anthropic API).
- Sanitization: There is no evidence of input validation, sanitization, or filtering of the incoming strings before they are processed by the AI models.
Audit Metadata