clinical-reports

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides a set of local Python scripts designed for medical terminology validation, de-identification checks, and template generation. All scripts use standard Python libraries and perform no network operations or suspicious file system modifications.
  • [DATA_EXPOSURE]: While the skill is intended to process Protected Health Information (PHI), it includes specialized tools like check_deidentification.py specifically designed to help users identify and remove the 18 HIPAA identifiers to prevent accidental data exposure.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes clinical reports which are typically provided as external text files. While this represents a data ingestion surface, the risk is mitigated by the fact that the processing is performed by local regex-based scripts rather than directly passing untrusted content into LLM prompts without structure.
  • Ingestion points: Files passed as arguments to scripts such as scripts/check_deidentification.py and scripts/validate_case_report.py.
  • Boundary markers: Not explicitly defined in the processing scripts.
  • Capability inventory: Uses the Bash tool to execute local validation and formatting scripts.
  • Sanitization: Validation scripts utilize regular expression pattern matching to extract and verify specific clinical data points.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 10:28 PM