skills/jeremylongshore/claude-code-plugins-plus-skills/checking-hipaa-compliance/Gen Agent Trust Hub
checking-hipaa-compliance
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data which could contain malicious instructions. * Ingestion points: The skill explicitly targets codebases, AWS infrastructure configuration files, and project documentation for analysis (SKILL.md). * Boundary markers: There are no specific delimiters or instructions defined to prevent the agent from executing instructions embedded within the data being scanned. * Capability inventory: The agent is granted access to high-capability tools including 'Read', 'Write', 'Edit', and 'Bash' (SKILL.md). * Sanitization: The instructions do not define any sanitization or validation steps for external content before it enters the agent's context.
- [NO_CODE]: The core logic of the skill is not present in the provided files. * Evidence: The README files in the 'scripts' and 'assets' directories list critical components such as 'hipaa_scan.py', 'config_validator.py', 'report_generator.py', and 'report_template.docx', but these files were not included in the analyzed package.
Audit Metadata