ClawHub
Back to skill

Security audit

Tcm Biomedical Research Strategist

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent research-planning skill, with caution needed around its public web-service links and non-clinical biomedical outputs.

Reasonable to install for computational herbal/TCM research planning. Treat outputs as hypothesis-generation guidance, not medical advice, and verify databases, retrieval dates, and important scientific claims independently. Prefer HTTPS sources and avoid uploading sensitive or unpublished data to public web tools unless their security and privacy controls have been reviewed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
references/data_sources.md:6
Finding

Plaintext HTTP Access to the HERB Research Database

Content
View full analysis

Vulnerability Details

File Location: references/data_sources.md:6
Vulnerability Type: Use of an unencrypted external service endpoint
Risk Level: Medium

Vulnerable Snippet:

markdown
- HERB (http://herb.ac.cn) — broader compound coverage for less-studied herbs

Technical Analysis

The Skill recommends accessing the HERB database over plaintext HTTP. HTTP does not authenticate the server or protect traffic integrity and confidentiality. An attacker with a privileged network position could impersonate the service, modify responses, inject misleading content, or observe submitted research queries.

Static analysis cannot establish whether this address currently redirects to HTTPS. Relying on an optional redirect remains weaker than specifying and enforcing an authenticated HTTPS endpoint directly.

Attack Path

  1. A researcher follows the Skill and opens the documented HTTP address.
  2. The connection traverses a compromised gateway, hostile wireless network, proxy, or other attacker-controlled network segment.
  3. The attacker intercepts the plaintext request before any possible HTTPS redirect.
  4. The attacker modifies the response or redirects the researcher to a spoofed database.
  5. Manipulated compound records enter the downstream screening and target-analysis workflow.

Impact Assessment

Exploitation does not grant local operating-system privileges or Agent control. Its scope is limited to the confidentiality and integrity of network traffic associated with this service. Successful exploitation could disclose research queries or corrupt compound data, causing inaccurate candidate selection and unreliable downstream scientific conclusions.

Remediation
View remediation

Remediation Suggestions

  • Replace the HTTP address with the service's verified HTTPS endpoint, if supported.
  • Confirm that TLS certificate validation succeeds and that the endpoint belongs to the intended organization.
  • Do not rely solely on an HTTP-to-HTTPS redirect, because the initial request remains susceptible to interception.
  • If HTTPS is unavailable, clearly warn users not to submit confidential or unpublished data and recommend an authenticated alternative source.
  • Record source versions, retrieval dates, and checksums for downloaded datasets to help detect unexpected modification.

T09 · Insecure Skill Coding Practices

Warning
Location
references/data_sources.md:11
Finding

Plaintext HTTP Endpoint Recommended for SwissTargetPrediction Batch Queries

Content
View full analysis

Vulnerability Details

File Location: references/data_sources.md:11
Vulnerability Type: Unencrypted submission of research inputs to an external service
Risk Level: Medium

Vulnerable Snippet:

markdown
- Swiss Target Prediction (http://www.swisstargetprediction.ch) — preferred for batch query

Technical Analysis

The documented endpoint uses HTTP while the Skill recommends it for batch target-prediction queries. Such queries can contain compound structures or identifiers. Plaintext transport provides no cryptographic server authentication, confidentiality, or response integrity.

A man-in-the-middle attacker could observe submitted compounds, replace prediction results, or redirect requests to a spoofed service. This risk is particularly relevant because references/minimal_executable_version.md:15 explicitly calls for a batch upload, although the vulnerable endpoint itself is defined at this location.

Attack Path

  1. A researcher prepares compound data for the prescribed batch query.
  2. The researcher accesses the documented HTTP endpoint through an attacker-observable network.
  3. The attacker intercepts the request, reads or alters the submitted compound information, or impersonates the prediction service.
  4. The attacker returns manipulated compound-target predictions.
  5. The altered predictions propagate into target intersection, PPI, enrichment, machine-learning, and docking analyses.

Impact Assessment

No local privileges, filesystem access, or code-execution rights are obtained through this issue alone. The attacker can potentially access research inputs transmitted through the connection and compromise returned prediction data. This may expose unpublished compound selections and undermine the integrity of much of the downstream analysis.

Remediation
View remediation

Remediation Suggestions

  • Replace the endpoint with a verified HTTPS URL and require certificate validation.
  • State that confidential, proprietary, patient-derived, or unpublished information must not be uploaded unless the service's privacy and security controls have been reviewed.
  • Prefer a documented HTTPS API or an approved local analysis method where available.
  • Preserve submitted inputs and raw returned results with checksums and retrieval timestamps.
  • Validate important predictions against a second independent source before using them in downstream prioritization.

T09 · Insecure Skill Coding Practices

Warning
Location
references/data_sources.md:42
Finding

Plaintext HTTP Access to TIMER2.0 Immune Analysis Services

Content
View full analysis

Vulnerability Details

File Location: references/data_sources.md:42
Vulnerability Type: Use of an unencrypted web-analysis endpoint
Risk Level: Medium

Vulnerable Snippet:

markdown
- TIMER2.0 (http://timer.comp-genomics.org) — web-based immune infiltrate estimation

Technical Analysis

The Skill directs researchers to a web-based immune-infiltration service through HTTP. Without TLS, an attacker in a network interception position can observe requests and modify pages or analysis responses. Because TIMER2.0 results are used to support immune-relevance conclusions, manipulated responses could create false correlations or suppress genuine findings.

The audit cannot confirm whether the service automatically redirects to HTTPS. Secure guidance should specify and validate HTTPS rather than depend on redirect behavior.

Attack Path

  1. A researcher follows the HTTP link to perform immune-infiltration analysis.
  2. A network-positioned attacker intercepts the unauthenticated connection.
  3. The attacker serves a spoofed page, modifies submitted parameters, or changes returned correlation results.
  4. The researcher incorporates the manipulated output into the immune-correlation matrix and final research plan.
  5. Incorrect immune-mechanism hypotheses are reported or prioritized for follow-up.

Impact Assessment

Exploitation provides no direct local-system or Agent privileges. The affected scope includes the confidentiality of submitted analysis parameters and the integrity of immune-analysis output. Scientific impact may include false-positive associations, missed signals, and misdirected experimental validation.

Remediation
View remediation

Remediation Suggestions

  • Use a verified HTTPS endpoint and reject TLS downgrade behavior.
  • Avoid uploading sensitive or unpublished datasets to a web service unless its data-handling policy has been assessed.
  • Prefer reproducible local implementations when practical, especially for sensitive expression data.
  • Save raw service responses, analysis parameters, and retrieval timestamps.
  • Cross-check important immune associations using an independent method or dataset before drawing conclusions.

T09 · Insecure Skill Coding Practices

Warning
Location
references/data_sources.md:45
Finding

Plaintext HTTP Access to the TISCH2 Single-Cell Reference Service

Content
View full analysis

Vulnerability Details

File Location: references/data_sources.md:45
Vulnerability Type: Use of an unauthenticated external data endpoint
Risk Level: Medium

Vulnerable Snippet:

markdown
- TISCH2 (http://tisch.comp-genomics.org) — single-cell immune deconvolution reference

Technical Analysis

The TISCH2 endpoint is specified using plaintext HTTP. This allows a network-positioned attacker to intercept requests, substitute downloaded reference information, modify displayed single-cell results, or redirect users to an imitation service.

TISCH2 is proposed as a reference for validating bulk immune-deconvolution findings at cell-type resolution. Corruption at this validation stage could make manipulated bulk-analysis results appear independently supported.

Attack Path

  1. A researcher accesses the documented TISCH2 HTTP endpoint.
  2. An attacker controlling or observing an intermediate network segment intercepts the request.
  3. The attacker modifies reference results, dataset metadata, or navigation responses.
  4. The researcher uses the altered information to validate cell-type assignments or immune associations.
  5. The compromised validation is included in the final mechanistic interpretation.

Impact Assessment

The issue does not enable direct command execution, privilege escalation, persistence, or access to unrelated local files. It affects service authenticity, traffic confidentiality, and research-data integrity. Successful exploitation could produce incorrect cell-type validation and misleading immune-mechanism conclusions.

Remediation
View remediation

Remediation Suggestions

  • Replace the address with an authenticated HTTPS endpoint after verifying service ownership.
  • Require normal TLS certificate and hostname validation.
  • Warn users against transmitting confidential or unpublished datasets through an unencrypted service.
  • Preserve dataset identifiers, source versions, timestamps, and exported results for reproducibility.
  • Validate consequential single-cell findings against another trusted repository or locally obtained reference dataset.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction 'Always use this skill — do not improvise' encourages forced invocation even when another skill or a general assistant response would be safer or more appropriate. This can suppress routing discretion, leading to overuse in borderline medical, pharmacology, or research requests where context-sensitive refusal, clarification, or redirection is needed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction 'Always use this skill — do not improvise' encourages forced invocation even when another skill or a general assistant response would be safer or more appropriate. This can suppress routing discretion, leading to overuse in borderline medical, pharmacology, or research requests where context-sensitive refusal, clarification, or redirection is needed.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.