fhir-basics

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides Python snippets that use subprocess.run to execute curl for network requests, which is a documented workaround for sandbox proxy constraints.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the well-known SMART on FHIR public test server (r4.smarthealthit.org) for synthetic data retrieval.
  • [INDIRECT_PROMPT_INJECTION]: Data is ingested from external FHIR API endpoints (SKILL.md). No explicit prompt boundary markers are included in the instructions. The skill capability inventory includes subprocess.run for network calls. Sanitization is performed through standard JSON parsing via json.loads.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 11:06 AM
Security Audit — agent-trust-hub — fhir-basics