sesion-workflow-clinic
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to clone a codebase from a repository (
https://github.com/fahad-hamid/psique-workflow-clinic.git) that is not owned by the skill author ('Aradotso') and is not associated with a recognized trusted organization. - [REMOTE_CODE_EXECUTION]: The installation instructions require the user to run
pnpm installandpnpm dev, which executes arbitrary code from the third-party repository on the local machine. - [PROMPT_INJECTION]: The skill possesses an Indirect Prompt Injection vulnerability surface in
backend/src/ai/claude.service.ts. - Ingestion points: Untrusted data from clinical session notes (
sessionNotes) and patient history (patientHistory) is processed by the AI service. - Boundary markers: Absent. The data is directly interpolated into the prompt string without delimiters or instructions to ignore embedded commands (e.g.,
...Notas de sesión:\n${sessionNotes}). - Capability inventory: The skill has network access via the WhatsApp automation service (
baileys) and generates summaries used in clinical workflows. - Sanitization: There is no evidence of escaping, validation, or filtering of the input data before it is sent to the LLM.
Audit Metadata