Fasten Connect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.6.0

Overview

The skill is coherent for Fasten health-record ingestion, but it handles real patient data and includes unsafe credential-handling guidance that deserves review before use.

Review this skill carefully before installing in any real patient-data environment. Use secret-managed credentials instead of putting private keys in shell commands, require real user authentication and patient consent checks on all HealthClaw endpoints, restrict tenant access server-side, and test with synthetic patients before enabling live TEFCA or EHI exports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:87

Finding

Fasten Private API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–90
Vulnerability Type: Private credential exposure through process arguments and shell history
Risk Level: Medium

bash

curl -X POST https://api.connect.fastenhealth.com/v1/bridge/fhir/ehi-export \
  -u "public_test_XXX:private_test_XXX" \
  -H "Content-Type: application/json" \
  -d '{"org_connection_id": "your-org-connection-id"}'

Technical Analysis

The documented command directs users to replace the placeholders with Fasten API credentials and pass the private key directly through curl's -u command-line option. Although the request is sent to the declared Fasten API over HTTPS, command-line arguments are not a secure secret-delivery mechanism.

A substituted private key may be exposed through shell history, process inspection facilities, terminal recording, CI/CD logs, command tracing such as set -x, or diagnostic and monitoring tools. This is an insecure credential-handling issue rather than evidence of covert exfiltration.

Attack Path

1. A user replaces private_test_XXX with a real test or live Fasten private key.
2. The user executes the command in an interactive shell or CI/CD environment.
3. The complete command and credential are retained in shell history, execution logs, process telemetry, or command-tracing output.
4. A local user, compromised build component, log reader, or monitoring-system account retrieves the exposed credential.
5. The attacker reuses the public/private key pair against the Fasten API within the permissions assigned to that credential.

Impact Assessment

Successful exploitation may provide unauthorized access to Fasten API operations available to the compromised key. This could include triggering patient EHI exports and interacting with sensitive health-record ingestion workflows.

The exact scope depends on the key's environment and server-side permissions. Exposure of a live credential ...[truncated 254 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place the private key literally in command-line arguments or committed command examples.
2. Retrieve credentials from an approved secret manager or another protected runtime credential source.
3. Prefer a server-side integration wrapper that reads the credential without exposing it in process arguments.
4. If curl must be used, supply credentials through a permission-restricted configuration mechanism and ensure the configuration file is excluded from version control:

   bash

   umask 077
   cat > /tmp/fasten-curl.conf <<'EOF'
   user = "public_test_XXX:private_test_XXX"
   EOF
   
   curl --config /tmp/fasten-curl.conf \
     -X POST https://api.connect.fastenhealth.com/v1/bridge/fhir/ehi-export \
     -H "Content-Type: application/json" \
     -d '{"org_connection_id":"your-org-connection-id"}'
   
   rm -f /tmp/fasten-curl.conf
   

   A production implementation should use a secret-backed, securely created file rather than manually entering the secret.
5. Disable shell command tracing around all secret-handling operations and configure CI/CD systems to mask Fasten credentials.
6. Restrict credential permissions to the minimum API operations and environment required.
7. Rotate any private key that has already been entered literally into a shell command, persisted in history, or emitted to logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The documented API endpoint is an external transmission path to Fasten that is used to initiate export of patient electronic health information. Because this skill is specifically for ingesting real EHR/TEFCA data, the external call is more sensitive than a generic API request: if invoked improperly, it can trigger transfer of regulated health data and expand exposure to third-party infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

4. Trigger an EHI Export (optional — Fasten may auto-trigger)

bash

curl -X POST https://api.connect.fastenhealth.com/v1/bridge/fhir/ehi-export \
  -u "public_test_XXX:private_test_XXX" \
  -H "Content-Type: application/json" \
  -d '{"org_connection_id": "your-org-connection-id"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The documented API endpoint is an external transmission path to Fasten that is used to initiate export of patient electronic health information. Because this skill is specifically for ingesting real EHR/TEFCA data, the external call is more sensitive than a generic API request: if invoked improperly, it can trigger transfer of regulated health data and expand exposure to third-party infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

4. Trigger an EHI Export (optional — Fasten may auto-trigger)

bash

curl -X POST https://api.connect.fastenhealth.com/v1/bridge/fhir/ehi-export \
  -u "public_test_XXX:private_test_XXX" \
  -H "Content-Type: application/json" \
  -d '{"org_connection_id": "your-org-connection-id"}'