nhcx-reprocess
Warn
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill contains logic to self-update by downloading a zip archive from a remote GitHub repository (github.com/nha-in/nhcx-package), replacing its own files on the filesystem, and instructing the AI to reload the new instructions. This behavior allows the skill's logic to change significantly after installation.
- [DYNAMIC_EXECUTION]: The skill instructs the AI to generate a report builder script (report.py or similar) in the target repository and execute it regularly to produce a progress report. Writing and running generated code is a significant capability that requires oversight.
- [COMMAND_EXECUTION]: The workflow involves running shell scripts (make-report.sh) and batch files to automate reporting. Additionally, the test runners are designed to execute system-level commands to install dependencies, such as pip install playwright and playwright install chromium.
- [EXTERNAL_DOWNLOADS]: The skill automatically checks for updates and downloads package manifests and software components from GitHub repositories and government endpoints (raw.githubusercontent.com, codeload.github.com, dev.abdm.gov.in). While these sources appear contextually appropriate for an Indian healthcare integration, the automated nature of these downloads is a risk factor.
- [PERSISTENCE]: The self-update mechanism ensures that any changes downloaded from the remote source are persisted to the local file system by overwriting the skill's original contents.
Audit Metadata