FHIR endpoint preflight

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 1.0.0

Overview

This is a narrow, disclosed FHIR endpoint preflight helper, with the main cautions being its PowMCP connection and unpinned setup command.

Install only if you are comfortable connecting to PowMCP and sending public FHIR endpoint details to that service. Do not use credential-bearing, private, or patient-data URLs, and prefer pinned or otherwise verified install sources where your environment supports them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-37
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

markdown

## Connect once

npx skills add powmcp/skills --skill preflight-client-endpoint-before-integration

text

Technical Analysis

The installation instructions invoke the third-party skills package through npx without specifying an exact package version or integrity digest. If the package is not already available locally, npx can retrieve and execute its currently published version. The powmcp/skills source is likewise referenced without an immutable commit identifier or reviewed release version.

Consequently, the code executed during installation can change after this Skill has been reviewed. Compromise of the npm package, its publisher account, or the referenced Skill repository could introduce malicious installation behavior through a later release. This is a supply-chain risk rather than evidence that the currently referenced package is malicious.

Attack Path

1. An attacker compromises the npm package, its publishing credentials, or the mutable powmcp/skills source.
2. The attacker publishes a modified package or repository revision containing malicious installation logic.
3. A user follows the documented npx skills add ... command.
4. npx resolves and downloads the mutable package version, while the installer resolves the mutable Skill source.
5. Attacker-controlled code executes in the user's environment during installation or subsequent Skill loading.
6. The payload operates with the permissions of the user who ran the command.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on that user's access and the behavior of the compromised package, the payload could read or alter accessible files, environment variables ...[truncated 251 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to a reviewed exact version, for example by using an explicit package version rather than allowing npx to resolve the latest release.
2. Pin powmcp/skills to an immutable commit hash, signed tag, or versioned release supported by the installer.
3. Use a lockfile and verify package integrity hashes where the installation workflow supports them.
4. Disable automatic acceptance of newly published versions and require security review before updating either dependency.
5. Prefer a trusted, preinstalled CLI in controlled environments instead of downloading executable package content at invocation time.
6. Run installation with the minimum required user privileges and without unnecessary credentials or sensitive environment variables.
7. Document the expected package version, source revision, and checksum so users can verify the reviewed artifact before execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to install and execute a remote package via npx skills add powmcp/skills without pinning an exact version. This creates a supply-chain risk: if the upstream package or dependency tree changes or is compromised, users may execute unintended code when following the setup instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill enables allow_implicit_invocation without any visible trigger constraints, exclusions, or additional policy gating. That can cause the agent to automatically invoke an external MCP tool based on loosely related user input, sending user-supplied FHIR endpoint URLs or surrounding context to a third-party service without an explicit invocation decision, which increases the risk of unintended data disclosure and tool misuse.

Content

No source excerpt is available for this finding.