abridge-reference-architecture
Warn
Audited by Snyk on Apr 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly ingests external, user-generated clinical notes via the Abridge Cloud API and EHR FHIR endpoints (see "Data Flow" step 8: "Integration service fetches note via API" and the fhirBaseUrl entries in src/config/multi-site.ts), which the agent is expected to read and act upon (webhook handling, redaction, pushing to EHR), so third-party content can materially influence behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata