FHIR Questionnaire Designer

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears coherent for designing FHIR questionnaires, with disclosed use of local Python helpers and external medical terminology APIs.

This skill is reasonable to install if you are comfortable with local Python helper scripts and external LOINC/SNOMED terminology lookups. Do not include PHI or confidential details in search terms, and have a qualified reviewer check clinical codes and generated questionnaires before production use.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run included Python scripts when helping with clinical coding and questionnaire validation.

Why it was flagged

The skill directs the agent to execute local Python helper scripts for terminology lookup. This is central to the stated purpose and is clearly disclosed, but users should understand that the skill depends on local tool execution.

Skill content

ALWAYS run `python scripts/search_loinc.py "search term"` FIRST

Recommendation

Use the skill in a normal project workspace, review generated questionnaire files before relying on them, and keep script execution limited to the documented workflows.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Terminology searches may disclose the clinical concepts being researched to third-party terminology services.

Why it was flagged

The skill discloses external terminology API calls. This is purpose-aligned, but clinical search terms or requirement text used in lookups may be sent to those external services.

Skill content

Requires whitelisted network access:
- `clinicaltables.nlm.nih.gov` (LOINC search)
- `tx.fhir.org` (FHIR terminology server for LOINC answer lists and SNOMED CT search)

Recommendation

Avoid including patient-identifying information or confidential business details in terminology search terms unless that external use is acceptable.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Manual setup may install a newer compatible dependency version than the author used.

Why it was flagged

The skill declares a Python dependency range but the registry provides no install specification. This is not suspicious by itself, but users may need to manage dependency installation and version selection themselves.

Skill content

metadata:
  dependencies: python>=3.8, jsonschema>=4.0.0

Recommendation

Prefer a pinned or project-managed Python environment if reproducibility matters, especially for clinical validation workflows.