From cpa
Security review for plugins acting as FHIR API clients - token management, scope validation, and patient-scoped authorization
How this skill is triggered — by the user, by Claude, or both
Slash command
/cpa:fhir-api-client-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill provides security review guidelines for Canvas plugins that act as FHIR API clients. Use it to audit token management, scope usage, and patient-scoped authorization when your plugin calls Canvas FHIR APIs or external FHIR endpoints.
This skill provides security review guidelines for Canvas plugins that act as FHIR API clients. Use it to audit token management, scope usage, and patient-scoped authorization when your plugin calls Canvas FHIR APIs or external FHIR endpoints.
Use this skill when:
Http() to call FHIR APIsPatient.objects, etc.)Reference the fhir_client_context.txt file for detailed patterns including:
npx claudepluginhub canvas-medical/coding-agents --plugin cpaGuides building FHIR R4 REST endpoints for Patient, Observation, Encounter, Condition, MedicationRequest including resource validation, HTTP status codes, value sets, coding systems (LOINC, SNOMED, RxNorm, ICD-10), and OperationOutcome error handling.
Guides HL7 FHIR R4 interoperability: resources CRUD/search, HAPI/Microsoft servers, SMART on FHIR auth, CDS Hooks, bulk export, US Core profiles.
FHIR agent guardrails for clinical data access via MCP. Provides 12+ tools for reading/writing resources with automatic PHI redaction, audit trails, and step-up authorization.