Security audit
Security checks for vulnerabilities and agentic risk
This is a simple healthcare billing-audit skill with sensitive-data handling concerns, but no hidden execution, persistence, credential use, or automatic external sending.
Install only if you are authorized to process the hospital_logs.json data. Review any generated report or WhatsApp draft before sharing it, remove patient-identifying or unnecessary clinical details, and use your organization's approved communication channel for healthcare or billing information.
The trigger phrase 'When asked to perform a medical audit' is broad and underspecified, so the skill may activate in contexts where the user did not explicitly intend access to hospital audit data or billing workflows. In a healthcare setting, ambiguous activation increases the chance of processing sensitive operational or patient-related records without clear user consent or appropriate scoping.
The skill instructs the agent to draft a WhatsApp message containing audit findings for a Hospital Administrator without any warning, consent step, or data-minimization guidance. Because the findings are derived from hospital surgical logs and billing data, the drafted message could expose sensitive financial or health-related information through an external communication channel that may be unauthorized or insecure.
