medcore-ai-route-audit

What problem does it solve?

This Skill prevents missing or inconsistent inference audit logging and prompt-injection vulnerabilities across MedCore AI endpoints, ensuring observability without leaking PHI.

Core Features & Use Cases

• Inference audit-row contract: Adds the canonical AI_<FEATURE>_INFERENCE row with model, prompt/response size, and latency in a PHI-safe way.
• Prompt-injection sanitization: Applies sanitizeUserInput to every free-text prompt field before it reaches the LLM/ASR prompt template.
• Test coverage that enforces safety: Pins success and failure paths, asserts negative PHI hygiene (forbidden keys absent), and verifies the sanitization behavior.
• Use during onboarding and remediation: Apply when adding new ai-*.ts routes, when an audit finding flags gaps, or when new free-text fields are introduced into prompts.

Quick Start

When you add a new AI route under apps/api/src/routes/ai-*.ts, apply this skill’s contract to stamp the model constant, sanitize all free-text prompt inputs with sanitizeUserInput, and add the paired test that asserts both inference audit-row correctness and PHI-absence.