openevidence-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes security best practices for clinical data, including timing-safe HMAC signature verification for webhooks and PII redaction for application logs.
- [CREDENTIALS_UNSAFE]: API key management is handled correctly by advising the use of HIPAA-compliant secret managers and environment variables rather than hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill handles clinical queries which are ingestion points for external data. It mitigates risk through Zod-based schema validation and regex-based PII sanitization (redacting names, dates, MRNs, and SSNs) before processing.
- [COMMAND_EXECUTION]: The code snippets are focused on web services and data processing, containing no shell command execution or subprocess spawning.
Audit Metadata