clinical-reports

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/generate_schematic_ai.py script performs network operations to openrouter.ai (a well-known AI service) to generate and critique scientific diagrams. This is a core feature of the skill used to enhance clinical reports with visual elements.\n- [COMMAND_EXECUTION]: scripts/generate_schematic.py uses subprocess.run to call a secondary internal Python script (generate_schematic_ai.py). The implementation follows best practices by using a list of arguments and a fixed script path, which mitigates command injection risks.\n- [PROMPT_INJECTION]: The schematic generation tool (scripts/generate_schematic_ai.py) ingests user-provided natural language descriptions to form prompts for external AI models. While this is essential for creating customized diagrams, it represents an indirect prompt injection surface if the descriptions are sourced from untrusted data.\n- [SAFE]: The skill includes dedicated privacy tools, such as scripts/check_deidentification.py, which proactively identifies HIPAA-protected identifiers (PHI) in text to ensure regulatory compliance and patient privacy.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 10:49 PM