ClawHub
Back to skill

Security audit

Fhir Upstream Proxy

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable guidance skill for a FHIR guardrail proxy; it describes sensitive healthcare access, but that access is disclosed and aligned with the skill’s stated purpose.

Install only if you understand the target FHIR server and have authorization to access it. Use sandbox endpoints by default, apply least-privilege credentials, and require human approval before allowing operations that could create, update, or delete clinical records.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly supports forwarding write operations to upstream FHIR servers, including production EHR environments, but does not prominently warn that using an AI agent in this mode can alter live clinical records. In a healthcare context, insufficient safety guidance around write-capable access materially increases the risk of unauthorized, mistaken, or unsafe modifications to patient data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill promotes connecting AI agents to production clinical data and production EHR systems while emphasizing guardrails, but it does not clearly state the residual privacy, authorization, and operational risks. This can create false assurance and lead operators to expose sensitive PHI or production systems without adequate consent, access control review, and change management.

Static analysis

No suspicious patterns detected.