clinical-decision-support
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill is designed to process untrusted clinical data provided by users to generate reports and analysis, creating a surface for indirect prompt injection.\n
- Ingestion points: User-provided cohort data and treatment parameters defined in prompts (e.g., 'Analyze a cohort of 45 NSCLC patients...').\n
- Boundary markers: Absent; the provided files do not define clear delimiters or instructions to ignore embedded commands in the clinical data.\n
- Capability inventory: Execution of local Python scripts (
generate_survival_analysis.py,create_cohort_tables.py, etc.) for statistical modeling and TikZ/LaTeX generation.\n - Sanitization: Absent; no evidence of input validation, escaping, or filtering for the clinical data being processed into reports.\n- Command Execution (SAFE): The README identifies several local Python scripts used for clinical data processing. While the script source code was not provided for analysis, the described functionality (survival analysis, table creation, decision tree building) is consistent with the skill's stated professional purpose.\n- External Downloads (SAFE): The skill references standard scientific Python packages (pandas, numpy, scipy, lifelines, matplotlib, pyyaml) hosted on trusted repositories (PyPI).
Audit Metadata