healthcare-providers-verify

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests practitioner data from the NPI registry and practice websites.
  • Ingestion points: Data is retrieved using nimble extract and nimble search commands during the verification process.
  • Boundary markers: The instructions specify a source priority list, including the official NPPES API and npidb.org, to minimize interaction with untrusted sites.
  • Capability inventory: The agent has access to shell commands (Bash) for tool execution, filesystem operations (Read/Write), and sub-agent spawning for parallel lookups.
  • Sanitization: Practitioner records are normalized and cross-referenced against standardized taxonomy descriptions and name-matching regex.
  • [EXTERNAL_DOWNLOADS]: Fetches practitioner records from the official government NPPES NPI Registry API (npiregistry.cms.hhs.gov), which is a well-known service.
  • [DYNAMIC_EXECUTION]: Employs inline Python code (via python3 -c) for generating date offsets and managing the local business profile. These scripts are derived from static templates within the skill instructions.
  • [COMMAND_EXECUTION]: Operates through the nimble CLI for web data retrieval and extraction. Onboarding documentation guides the user through the installation of this vendor-provided utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:56 PM