ClawHub
Back to skill

Security audit

PubMed Search Specialist

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal PubMed query-building skill, with the main caution that some English-only search examples could bias literature results.

Before installing, understand that this skill locally helps generate PubMed search strings and does not appear to require sensitive credentials. For systematic reviews, guidelines, or clinical evidence work, avoid English-only, date, human-only, or age filters unless the user request or review protocol explicitly justifies them, and verify suggested MeSH terms against current NLM/PubMed sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The skill documentation includes an English-language filter example without requiring explicit user consent or documenting when language restriction is appropriate. In literature retrieval, silent language filtering can bias evidence gathering, exclude relevant non-English studies, and undermine reproducibility or systematic review quality.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The examples present an English-language filter as a standard option without warning that it can systematically exclude relevant non-English studies. In a PubMed search specialist skill, this creates a real risk of biased or incomplete evidence retrieval, especially for systematic reviews, guideline development, or safety-sensitive clinical questions.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The line-by-line template hard-codes English in the default strategy, which can cause users to unknowingly adopt a biased search design. Because this template is likely to be copied directly into literature review workflows, it amplifies the chance of systematic exclusion of non-English evidence and undermines reproducibility and methodological quality.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.