fasten-ehr-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download the Fasten Connect Stitch widget from its official content delivery network (cdn.fastenhealth.com). This is a standard procedure for integrating the client-side component of the Fasten Connect service.
- [COMMAND_EXECUTION]: The integration guide suggests using well-known utilities such as Cloudflare Tunnel (cloudflared) or ngrok to facilitate local development and testing of webhook endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external patient health records (FHIR data in NDJSON format) and webhook payloads, which constitutes a data ingestion surface.
- Ingestion points: Ingestion occurs via the webhook endpoint (POST /api/webhooks/fasten) and FHIR resource files downloaded from the Fasten Connect API.
- Boundary markers: The instructions do not specify explicit boundary markers for the data, but they do emphasize that the data is for display and internal storage.
- Capability inventory: The skill includes network capabilities (fetching records from the API) and file system writes (generating an architecture brief).
- Sanitization: The skill provides explicit guidance on defensive parsing, such as skipping malformed lines and using specific fallback logic when rendering clinical codes and text to prevent rendering errors or injection from unexpected data structures.
Audit Metadata