fhir

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to accept user-supplied secrets (the full callback URL containing an auth code, client_id, and optionally bearer_token) and to pass them verbatim into MCP calls (connect/connect_complete and printed env snippets), which requires the LLM to handle and output sensitive values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow fetches outsider-authored free text from a remote FHIR server via fhir MCP get_document_content / doc-extract, and that extracted text is then passed into the clinical-note-extract step (even though it’s intended to be handled in a no-tools worker, it still enters the agent/LLM context as input for extraction).