clinic-revenue-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text input representing medical revenue tables, creating a potential surface for indirect prompt injection attacks.\n
- Ingestion points: Input processed via the text field in scripts/run.mjs and the parsing logic in scripts/engine/clinic-revenue-check.js.\n
- Boundary markers: No specific delimiters or boundary markers are employed to isolate untrusted data during analysis.\n
- Capability inventory: The skill is authorized to use the Read and Bash tools.\n
- Sanitization: Data is normalized for numeric consistency but the skill lacks mechanisms to identify or filter embedded instructions.\n- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install the official Alipay agent payment utility using the command npx -y @alipay/agent-payment@latest install. This facilitates upgrading the skill using an official package from a well-known service provider.
Audit Metadata