digital-health-clinical-asr-setup
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Detailed analysis confirms that the skill provides a legitimate setup workflow without introducing security risks.
- [CREDENTIALS_UNSAFE]: The skill implements secure management of API keys by recommending environment variables and providing length-only validation scripts, which prevents the leakage of secret values in logs.
- [EXTERNAL_DOWNLOADS]: Python dependencies are sourced from trusted public registries and include vendor-maintained libraries such as nvidia-riva-client.
- [DATA_EXFILTRATION]: Outbound communication is restricted to verified domains (nvidia.com, dictionaryapi.com) necessary for the flywheel's operation, and the skill explicitly forbids the use of real patient data.
- [COMMAND_EXECUTION]: Executable commands are limited to environment bootstrapping and a static smoke test recipe with no user-input injection vulnerabilities.
Audit Metadata