Security audit

Target Research

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed PatSnap-powered research assistant for drug-target reports; the claimed Google Drive backup behavior was not supported by the inspected artifact.

Install this only if you are comfortable connecting PatSnap LifeScience MCP services and using a PatSnap API key from your agent environment. Research queries and retrieved target intelligence may go to PatSnap and, when needed, web search; review your account terms before using confidential commercial or biomedical strategy data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to upload generated reports to Google Drive via rclone even though the stated purpose is target research and report generation, not external transmission or persistence. This creates an unnecessary data egress path that could expose user prompts, proprietary research outputs, or sensitive workspace content to a third-party cloud destination without explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The output-path section expands the skill from report generation into local retention and cloud backup, increasing data persistence beyond what is necessary for the task. Unnecessary retention and duplication raise privacy, compliance, and accidental disclosure risks, especially if reports contain confidential commercial or biomedical analysis.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger condition appears to activate on any mention of a target name, which is overly broad for a high-effort research skill. Over-triggering can cause unintended tool use, excessive data collection, unnecessary external queries, and generation of reports when the user may only be asking a passing or unrelated question.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs uploading reports to Google Drive without a user-facing warning or consent flow describing external transmission. In this context, target research reports may include sensitive internal analyses or strategy, so undisclosed cloud transfer materially increases confidentiality and governance risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The mandatory cloud backup requirement discloses neither privacy implications nor handling of potentially sensitive reports, despite sending data to an external storage provider. Because the skill concerns pharmaceutical target analysis, the resulting documents may have commercial sensitivity, making silent backup more dangerous than in a low-sensitivity domain.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.