case-summary
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses the
$ARGUMENTSplaceholder to receive user input for patient identification. This is a potential surface for prompt injection where a user might provide instructions instead of a patient name to attempt to override the agent's behavior. - [COMMAND_EXECUTION]: The skill metadata indicates a requirement for the
python3binary for execution. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from the medical data it processes.
- Ingestion points: The skill fetches data from several FHIR endpoints (Patient, Condition, Observation, MedicationRequest, Encounter) as defined in SKILL.md.
- Boundary markers: The instructions lack delimiters or explicit 'ignore instructions' warnings when processing the retrieved data.
- Capability inventory: The skill utilizes data retrieval tools but does not invoke dangerous capabilities like arbitrary shell execution, file system writes, or network operations to non-FHIR domains.
- Sanitization: No sanitization or validation of the clinical data is specified before it is incorporated into the final summary.
Audit Metadata