healthcare-providers-verify
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests practitioner data from the NPI registry and practice websites.
- Ingestion points: Data is retrieved using
nimble extractandnimble searchcommands during the verification process. - Boundary markers: The instructions specify a source priority list, including the official NPPES API and npidb.org, to minimize interaction with untrusted sites.
- Capability inventory: The agent has access to shell commands (Bash) for tool execution, filesystem operations (Read/Write), and sub-agent spawning for parallel lookups.
- Sanitization: Practitioner records are normalized and cross-referenced against standardized taxonomy descriptions and name-matching regex.
- [EXTERNAL_DOWNLOADS]: Fetches practitioner records from the official government NPPES NPI Registry API (npiregistry.cms.hhs.gov), which is a well-known service.
- [DYNAMIC_EXECUTION]: Employs inline Python code (via
python3 -c) for generating date offsets and managing the local business profile. These scripts are derived from static templates within the skill instructions. - [COMMAND_EXECUTION]: Operates through the
nimbleCLI for web data retrieval and extraction. Onboarding documentation guides the user through the installation of this vendor-provided utility.
Audit Metadata