Skill Being Reviewed
Skill name: hipaa-review
Skill path: skills/compliance/hipaa-review/
False Positive Analysis
Benign code that triggers a false positive:
Emergency PHI access has pre-approved workflow and immutable post-use review.
Why this is a false positive:
The current review guidance can push an agent to flag this pattern without first proving the attacker-controlled path, tenant boundary, or effective runtime behavior. The review should require evidence before classification.
Coverage Gaps
Missed variant 1:
Break-glass role can view ePHI without reason capture or manager review.
Why it should be caught:
This is a realistic failure mode for hipaa-review. It changes the effective security boundary without matching the simpler examples currently emphasized by the skill.
Missed variant 2:
Emergency access logs are stored in same system the privileged user can alter.
Why it should be caught:
This variant commonly appears in production systems and needs explicit reviewer prompts so agents do not stop at static configuration review.
Edge Cases
HIPAA permits emergency access but requires accountability.
Remediation Quality
Comparison to Other Tools
| Tool |
Catches this? |
Notes |
| Semgrep |
Partial |
Can catch static patterns, but not effective policy, ownership, or runtime propagation without custom rules. |
| CodeQL |
Partial |
Strong for code/data-flow cases, weaker for cloud/control-plane and process evidence unless modeled. |
| Other: manual review |
Yes |
Human review can verify effective behavior, exception ownership, and operational evidence. |
Overall Assessment
Strengths:
The skill gives useful practitioner framing and asks for concrete evidence instead of generic advice.
Needs improvement:
Need break-glass safeguard evidence.
Priority recommendations:
- Add a checklist item for break-glass audit trail evidence evidence.
- Add one benign exception example so reviewers avoid noisy findings.
- Add one regression or verification step that proves the effective boundary after remediation.
Bounty Info
Skill Being Reviewed
Skill name: hipaa-review
Skill path:
skills/compliance/hipaa-review/False Positive Analysis
Benign code that triggers a false positive:
Why this is a false positive:
The current review guidance can push an agent to flag this pattern without first proving the attacker-controlled path, tenant boundary, or effective runtime behavior. The review should require evidence before classification.
Coverage Gaps
Missed variant 1:
Why it should be caught:
This is a realistic failure mode for hipaa-review. It changes the effective security boundary without matching the simpler examples currently emphasized by the skill.
Missed variant 2:
Why it should be caught:
This variant commonly appears in production systems and needs explicit reviewer prompts so agents do not stop at static configuration review.
Edge Cases
HIPAA permits emergency access but requires accountability.
Remediation Quality
Comparison to Other Tools
Overall Assessment
Strengths:
The skill gives useful practitioner framing and asks for concrete evidence instead of generic advice.
Needs improvement:
Need break-glass safeguard evidence.
Priority recommendations:
Bounty Info
samik4184@gmail.com