abridge-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources via
WebFetchand then generate reports using theWriteandEdittools. This workflow creates an indirect prompt injection surface where instructions hidden in the documentation could potentially influence the agent's output. - Ingestion points: Usage of
WebFetchto read external Abridge and HHS documentation as described inSKILL.mdandreferences/official-docs.md. - Boundary markers: The skill does not explicitly define delimiters or specific "ignore embedded instructions" warnings for the fetched content.
- Capability inventory: The skill utilizes
Read,Glob,Grep,WebFetch,Write, andEdittools. - Sanitization: No explicit sanitization or validation of the content retrieved via
WebFetchis documented before it is processed for findings. - [EXTERNAL_DOWNLOADS]: The skill references and fetches content from
trust.abridge.com,support.abridge.com, andhhs.gov. These are official vendor and government service domains used to verify security postures and regulatory guidance.
Audit Metadata