Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for FHIR guardrails, but it handles clinical data and forwards upstream queries while overclaiming some security guarantees, so users should review it before use.
Before installing, confirm where upstream FHIR queries are sent, whether query parameters can contain PHI, what logs are retained, and whether audit records are actually tamper-evident in your deployment. Treat the advertised immutability and compliance protections as claims to verify, not guarantees from the inspected artifact.
The skill claims an 'append-only' and 'database-level immutable' audit trail, but elsewhere states local mode uses SQLite JSON blob storage. SQLite alone does not provide strong immutability guarantees, so operators may rely on audit logs for compliance or incident response when those logs could be altered or deleted by a sufficiently privileged actor.
The documentation says that in upstream proxy mode, all query parameters are forwarded to the upstream server without an explicit warning about external transmission of clinical query data. In this healthcare context, query parameters can contain patient identifiers, codes, and other sensitive metadata, so silent forwarding can leak PHI or tenant-sensitive information to third parties or less-trusted infrastructure.
The manifest says the skill provides '14 MCP tools' at L010, while the detailed tool list header says 'MCP Tools Available (12)' at L032 and the tables enumerate 12 tools total. This creates a description-behavior mismatch in the documented scope of the skill.
No suspicious patterns detected.
