digital-health-clinical-asr-eval
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill's behavior matches its stated purpose of evaluating clinical ASR models.
- [EXTERNAL_DOWNLOADS]: The skill interacts with official NVIDIA gRPC services (
grpc.nvcf.nvidia.com) to perform ASR transcription. This is a legitimate and documented operation for a cloud-based ASR evaluation tool. - [DATA_EXFILTRATION]: Audio clips and reference transcripts are sent to NVIDIA's ASR service. The skill explicitly discloses this behavior to the user and includes strong warnings against transmitting real patient audio or Protected Health Information (PHI), emphasizing the use of synthetic data.
- [COMMAND_EXECUTION]: The skill provides Python code recipes for processing manifest files and calculating error metrics (WER, CER, KER, SER). These recipes use standard libraries and do not involve suspicious operations such as privilege escalation or arbitrary code execution from untrusted sources.
- [CREDENTIALS_UNSAFE]: The skill requires an
NVIDIA_API_KEYfor authentication with hosted NIMs, but it correctly instructs the user to export this as an environment variable rather than hardcoding any secrets.
Audit Metadata