medical-chart-review
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill consists entirely of Markdown documentation and templates. No executable scripts (Python, JavaScript, Shell) or binary files are present within the skill files.
- [SAFE]: The skill implements a robust 'Safety & Compliance Gate' in SKILL.md. This requires the agent to verify PHI (Protected Health Information) status and HIPAA compliance before reading or processing any chart content.
- [SAFE]: No network operations, data exfiltration patterns, or hardcoded credentials were detected. The skill explicitly prohibits writing PHI to persistent storage or session memory.
- [SAFE]: No obfuscation techniques, such as Base64 encoding, zero-width characters, or homoglyph substitutions, were found in the documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (medical charts). While this presents an attack surface for indirect prompt injection, the skill includes specific mitigations:
- Ingestion points: Medical chart text provided by the user (SKILL.md §3).
- Boundary markers: Explicit safety gates and disclaimers are required before processing (SKILL.md §0).
- Capability inventory: The skill is limited to text analysis and structured report generation using provided templates; it lacks file-write or network-send capabilities.
- Sanitization: Instructions explicitly command the agent to 'Never invent' and 'Never alter' the source data, reducing the risk of being misled by injected content.
Audit Metadata