clinical-trials-search
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a
findcommand within the user's home directory (~/.claude/plugins/cache) to resolve the absolute path of its internal scripts. - [COMMAND_EXECUTION]: The skill relies on executing local bash and Node.js scripts (
scripts/search,scripts/search.mjs) to facilitate the search and setup functionality. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
api.valyu.aito retrieve clinical trial data and documentation. - [PROMPT_INJECTION]: The skill is subject to potential indirect prompt injection as it fetches and processes full-text content from an external API (ClinicalTrials.gov via Valyu) without explicit sanitization or boundary markers.
- Ingestion points: Clinical trial outcomes and details retrieved from
api.valyu.aiare incorporated into the agent's context. - Boundary markers: Absent. No specific delimiters are defined to separate external data from system instructions.
- Capability inventory: The agent has shell execution capabilities via the provided scripts.
- Sanitization: Not specified. The documentation does not mention validation or filtering of the retrieved content.
Audit Metadata