fhir-data-access
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and processing clinical data from external FHIR-compliant EHR systems.
- Ingestion points: Untrusted clinical data enters the agent context from multiple FHIR resources, including Patient, Observation, Condition, and MedicationRequest endpoints.
- Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded prompts within the retrieved clinical data.
- Capability inventory: The skill enables full CRUD (Create, Read, Update, Delete) operations on healthcare resources and data aggregation/analysis, meaning successful injection could potentially influence clinical summaries or write-back operations.
- Sanitization: No explicit sanitization or filtering of incoming clinical text is documented to prevent malicious instructions hidden in patient records from affecting agent behavior.
Audit Metadata