fittings-ctgov-eligibility-screen
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES]: The skill instructions direct the user to download a JavaScript file (
call.mjs) from the vendor's domain (fittings.sh) usingcurland execute it withnode. While the source is the skill's own vendor, this pattern introduces a dependency that is fetched at runtime rather than being bundled with the skill. - [DYNAMIC_EXECUTION]: The skill relies on the execution of the downloaded
call.mjsscript to interact with the API and settle payments, representing a runtime execution of external code. - [INDIRECT_PROMPT_INJECTION]: The skill processes clinical trial data, including inclusion and exclusion criteria, from the ClinicalTrials.gov API.
- Ingestion points: Trial criteria text retrieved from the
ctgov.eligibility-screenendpoint. - Boundary markers: No specific delimiters are mentioned in the instructions to isolate trial data from the agent's control flow.
- Capability inventory: The agent performs analysis and decision-making (screening) based on the ingested trial criteria.
- Sanitization: The documentation does not describe explicit sanitization or filtering of the content retrieved from the external registry.
Audit Metadata