nhcx-payer-communication
Warn
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains a self-update mechanism in
SKILL.mdthat instructs the agent to download a ZIP archive fromgithub.com/nha-in/nhcx-package, extract it, and replace the current skill's folder with the downloaded content. This allows the skill to dynamically update its own instruction set from a remote repository. - [EXTERNAL_DOWNLOADS]: The skill frequently fetches external data from
github.com/nha-in/nhcx-package, including a 'Knowledge Source' and protocol manifests. It also relies on an external MCP server (nhcx-docs) for fetching specifications and validating data. - [DYNAMIC_EXECUTION]: In
steps/L1-discovery.md, the agent is instructed to write a report builder script (report.pyor equivalent) into the target repository. Subsequent steps involve executing this generated script and associated wrapper shells (make-report.sh) to produce HTML documentation. - [CREDENTIALS_UNSAFE]: The skill handles sensitive Indian healthcare infrastructure (ABDM) credentials.
gateway/G2-configuration.mddescribes configuration patterns for reading RSA private keys and client secrets from local files and environment variables. While the skill advocates for keeping secrets out of version control, the instruction logic requires the agent to manage these sensitive materials. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and parsing external FHIR bundles and 'Knowledge Source' data. This creates an attack surface where maliciously crafted data from the remote vendor repository or the MCP server could influence the agent's behavior during code generation and testing phases (L5 through L8).
Audit Metadata