healthcare-ops

Warn

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: MEDIUMPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The skill contains directives to enter 'AUTONOMOUS MODE' and 'Do NOT ask questions,' which are designed to override the agent's standard conversational guidelines and interactive safety protocols.
  • [DATA_EXFILTRATION]: The skill attempts to access and modify files within the '~/.claude/projects/' directory. This is a sensitive location containing application-specific state, project memory, and potentially conversational history from the agent's execution environment.
  • Evidence: The 'SELF-EVOLUTION TELEMETRY' section instructs the agent to search for the project path in '~/.claude/projects/' and append metadata to 'skill-telemetry.md'.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it interpolates user-provided input from the '$ARGUMENTS' variable directly into the task instructions without sanitization or boundary markers.
  • Ingestion points: SKILL.md (via $ARGUMENTS placeholder)
  • Boundary markers: Absent
  • Capability inventory: The skill possesses extensive file reading capabilities (reviewing the entire codebase) and can call other specialized healthcare skills.
  • Sanitization: Absent
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 23, 2026, 10:59 AM
Security Audit — agent-trust-hub — healthcare-ops