clinical-reports
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runinscripts/generate_schematic.pyto orchestrate internal script execution for image generation tasks. - [EXTERNAL_DOWNLOADS]: The script
scripts/generate_schematic_ai.pyperforms network communication withopenrouter.aito access generative models. This involves sending user-provided prompts and generated image data to a remote API. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted clinical data. Ingestion points occur in
scripts/validate_case_report.pyandscripts/check_deidentification.pywhere medical text is processed. The skill lacks explicit boundary markers or instructional sanitization, which, when combined with its access to theBashandWritetools, presents a low-severity security risk.
Audit Metadata