healthcare-ops
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill contains directives to enter 'AUTONOMOUS MODE' and 'Do NOT ask questions,' which are designed to override the agent's standard conversational guidelines and interactive safety protocols.
- [DATA_EXFILTRATION]: The skill attempts to access and modify files within the '~/.claude/projects/' directory. This is a sensitive location containing application-specific state, project memory, and potentially conversational history from the agent's execution environment.
- Evidence: The 'SELF-EVOLUTION TELEMETRY' section instructs the agent to search for the project path in '~/.claude/projects/' and append metadata to 'skill-telemetry.md'.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it interpolates user-provided input from the '$ARGUMENTS' variable directly into the task instructions without sanitization or boundary markers.
- Ingestion points: SKILL.md (via $ARGUMENTS placeholder)
- Boundary markers: Absent
- Capability inventory: The skill possesses extensive file reading capabilities (reviewing the entire codebase) and can call other specialized healthcare skills.
- Sanitization: Absent
Audit Metadata