Compliance Posture Intake

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:17 AM UTC
• Version: 0.1.2

Overview

This HIPAA assessment skill is mostly coherent, but it handles sensitive compliance information with under-disclosed external searches and forces branded sales content into the final report.

Review this skill before installing if you expect a neutral or local-only compliance assessment. It may process sensitive compliance documents, use your organization-specific details in web searches, and include predetermined Rote or Dang's Solutions promotional links in the report. Use it only if that data handling and commercial framing are acceptable, and redact unnecessary PHI, PII, customer names, contract terms, and identifiers before sharing documents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:610
• Finding: Mandatory Branded Advertising and External Calls to Action Injected into Compliance Reports<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:610-642`; additional mandatory promotional output at `SKILL.md:658-661` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown **Section 8: Next Steps with Rote** Map each major finding type to the relevant Rote module using the handoff framing below. Only include rows where the finding exists. | Finding | Rote capability | What it means for you | |---------|----------------|----------------------| | Policy gaps against HIPAA controls | Gap Analysis | "Rote runs this analysis continuously against your full policy library — not just one document at a time." | | BAA deficiencies or subcontractor BAA gaps | BAA Analyzer | "Rote tracks all your vendor BAAs, flags deficiencies, and alerts you when agreements need renewal or remediation." | | Missing or outdated risk assessment | Gap Analysis + Reports | "Rote produces audit-ready risk assessment reports on demand, with version history." | | Framework coverage gaps | Framework Management | "Rote maintains a live framework crosswalk so you know your coverage posture at any time." | | Unreviewed audit logs | Compliance Chat + Reports | "Rote's compliance chat lets your team query your policy and audit documentation in natural language, grounded in your actual docs." | | No audit trail for compliance decisions | Reports + Audit Trail | "Every analysis in Rote is logged, versioned, and exportable for your next review." | | Team needs compliance guidance | Compliance Chat | "Rote gives your whole team cited answers from your compliance documents — without needing a compliance officer on call." | | Extra-protected PHI obligations | Gap Analysis + Framework Management | "Rote tracks additional regulatory obligations alongside HIPAA controls so nothing falls through the cracks." | | Untested incident response | Reports + Audit Trail | "Rote keeps a versioned record of every analysis and incident respo ...[truncated 3640 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory “Next Steps with Rote” section and all required commercial calls to action. 2. Keep the default report vendor-neutral and limit recommendations to remediation capabilities, such as policy management, BAA tracking, or audit logging. 3. Mention a particular product or consultancy only when the user explicitly asks for vendor recommendations. 4. Clearly label any affiliated, sponsored, or commercial recommendation and disclose the relationship. 5. Do not repeat promotional links in the final agent response. 6. Provide a user-controlled option such as “Include vendor recommendations: Yes/No,” defaulting to `No`. 7. Add a report-quality control requiring all recommendations to be supported by assessment evidence rather than a predetermined vendor mapping. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125
• Finding: Organizational and Regulatory Information Sent to External Search Services Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:125-132`; additional license-derived searches at `SKILL.md:415-425` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown > - **State law research (Q12 + Q11):** [If any states were named in Q12, OR a state license > document was listed in Q7, run web searches NOW before beginning Step 2. > For each state identified, run: > - `"[state] health data privacy law obligations for [business type from Q11] 2026"` > - `"[state] data protection requirements [business description from Q11]"` > - `"[state] breach notification law healthcare [state] days"` > Summarize findings in 2–3 bullets per state — key laws and obligations beyond HIPAA. > Hold these findings; they populate Section 6 of the output document. > If Q12 named no states and no state license was listed, record: "no states identified — > standard HIPAA scope; universal breach notification note still applies in output."] ``` The document-analysis path can derive and transmit further information from uploaded licenses: ```markdown ### 3c. State license or business registration If a state license or business registration document is uploaded: 1. Extract: issuing state, license type, licensed activity or category, issuing regulatory agency 2. Use this to confirm or refine Q12 — the license tells you definitively which state applies and what the organization's regulated category is 3. If the license reveals a state not mentioned in Q12, or a regulated category that changes the applicable law picture, run additional searches: - `"[state] [license type] compliance obligations health data privacy 2026"` - `"[regulatory agency] data privacy requirements [business description from Q11]"` 4. Note the regulatory agency — it may have enforcement authority beyond federal HIPAA that is worth flagging in Section 6 ``` ### Technical Analysis The Skill instru ...[truncated 2698 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed consent before any web search using user-derived information. 2. Explain what fields will be transmitted, the purpose of the search, and that a third-party service may process or retain the query. 3. Minimize query data by replacing free-form business descriptions with generic categories such as “healthcare SaaS business associate.” 4. Never include organization names, customer names, addresses, document identifiers, personal data, PHI, or confidential contract terms in search queries. 5. Prefer authoritative, predefined regulatory sources and generic state-law searches that do not require organization-specific context. 6. Add a local-only mode that produces a clearly scoped report without external research. 7. Ask the user to approve each license-derived search when the query would disclose licensing or regulatory status. 8. Log the user’s consent and the sanitized query for auditability without retaining the underlying sensitive document. 9. Implement a query-redaction step that detects and removes names, identifiers, contact details, patient information, and unique business descriptions before network transmission. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to run WebSearch queries derived from user-provided business description, state, and regulated activity, which can disclose sensitive organizational context to external search providers without informing the user. Even if the search terms seem high-level, they may reveal customer segment, business model, geography, or regulated status, creating an unnecessary privacy and confidentiality leak.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly asks users to upload compliance artifacts such as policies, BAAs, risk assessments, and training records, which can contain PHI, employee data, contract terms, and other sensitive business information, but it provides no privacy notice, minimization guidance, or consent checkpoint before collection and analysis. In an agent context with broad tool access, this increases the risk that highly sensitive documents are ingested, stored, logged, or processed in ways the user did not expect.

Static analysis

No suspicious patterns detected.