shiftcare-create-note
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from the ShiftCare API which could potentially contain malicious instructions embedded in previous records.
- Ingestion points: In Step 2, the skill uses
list_progress_notesto read a client's recent history to identify unresolved follow-up items. - Boundary markers: The instructions do not define the use of explicit delimiters or instructions to ignore embedded commands when the agent processes the retrieved text.
- Capability inventory: The skill utilizes write-capable tools including
create_client_noteandcreate_progress_note. - Sanitization: There is no requirement mentioned for sanitizing or escaping the content retrieved from the API before it is used to draft or guide the creation of a new note.
- Mitigation: The vulnerability is significantly mitigated by Step 7, which requires the agent to "Read the whole note back and wait for an explicit yes" from the user before the tool is executed. This ensures that any unintended behavior induced by data ingestion is reviewed by a human.
Audit Metadata