health-human-factors
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing external source code, markup, and configuration files, which constitutes a potential surface for indirect prompt injection.
- Ingestion points: According to the Operating Rules and Workflow in
SKILL.md, the agent reads clinical UI screens, source files, and markup from the provided repository paths. - Boundary markers: The skill contains a 'Prompt injection boundary' directive in
SKILL.mdthat explicitly instructs the agent to treat embedded instructions as data and not to act on them. - Capability inventory: The skill is restricted to producing a report. It is explicitly prohibited from changing code, designs, or configurations, and does not have access to tools for network communication or subprocess execution.
- Sanitization: The skill relies on natural language boundary instructions for safety; no automated sanitization or structured schema validation is mentioned.
- [SAFE]: The static analysis flag for prompt injection is a false positive. The suspicious phrases ('ignore previous instructions', 'you are now') appear in
SKILL.mdas part of a defensive safety guideline intended to protect the agent from malicious content in the data it analyzes, rather than as an attempt to bypass agent security filters.
Audit Metadata