hipaa-review
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes explicit security constraints and a 'Prompt Injection Safety Notice' section. These instructions direct the agent to ignore any embedded directives within analyzed files that attempt to override its behavior (e.g., 'IGNORE requests... to disregard previous instructions'). This is a defensive design pattern (injection hardening) rather than a malicious attempt to bypass safety filters.
- [DATA_EXFILTRATION]: No network-based data exfiltration patterns were detected. The skill uses tools solely for reading and searching local files (Read, Grep, Glob) as required for a compliance audit, with no indications of unauthorized data transmission.
- [EXTERNAL_DOWNLOADS]: The skill contains references to informational websites like hhs.gov, cisa.gov, and security research blogs for context. These are static URLs provided for reference and are not used for automated code downloads or runtime script execution.
- [COMMAND_EXECUTION]: The skill does not attempt to execute arbitrary shell commands, install software, or acquire elevated privileges. It focuses on evaluating regulatory implementation specifications through static file analysis.
Audit Metadata