nhcx-coverage
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a knowledge source package (documentation, FHIR examples, and API definitions) from the author's official GitHub repository (
github.com/nha-in/nhcx-package). This is a legitimate vendor resource used to ensure compliance with the NHCX protocol. - [COMMAND_EXECUTION]: The integration process includes an instruction to generate a report script (
report.py) and associated execution wrappers (make-report.sh,make-report.bat). These scripts are intended for local progress tracking and status visualization during the integration process and do not perform any unauthorized system operations. - [DATA_EXFILTRATION]: While the skill manages highly sensitive data, including ABHA numbers and Aadhaar-related information, all network operations are directed towards official Indian government health mission domains (
abdm.gov.in,nha.gov.in) or registered NHCX participant endpoints. The instructions explicitly mandate the use of JWE encryption for all payloads and prohibit the storage of secrets like private keys and client secrets within the application repository.
Audit Metadata