HIPAA Gap Analysis

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This is a purpose-aligned HIPAA assessment skill with a disclosed external API, but users should treat the submitted compliance details as sensitive.

Installers should use this as a compliance planning aid, not legal advice. Before submitting real organization data, confirm ToolWeb's privacy, retention, and HIPAA/business-associate posture, avoid patient-identifiable PHI unless approved, and use the minimum detail needed for the assessment. VirusTotal is still pending, but static and artifact review found no hidden code or automatic execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill is explicitly designed to send organization compliance details and potentially sensitive PHI-related context to an external third-party API, but it does not provide a clear user-facing warning, data handling disclosure, or minimization guidance. In a healthcare context, even metadata about PHI volume, PHI types, incidents, vendors, and safeguards can be highly sensitive and may create regulatory, contractual, and confidentiality exposure if transmitted without informed consent and vendor due diligence.

VirusTotal

66/66 vendors flagged this skill as clean.