Security audit

pubmed-literature-viewer

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent PubMed lookup tool, but it normalizes putting an API key into chat, which users should review before installing.

Install only if you are comfortable with the skill sending your search terms to PubMed/NCBI. Do not paste an NCBI API key into chat; use the documented NCBI_API_KEY environment variable or a platform secret mechanism instead. Normal small PubMed searches do not require a key.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to run a local Python script that uses network access and may consume environment-provided secrets (`NCBI_API_KEY`), but the skill declares no corresponding permissions. This creates a capability/consent mismatch: users and the platform may not realize the skill can make outbound requests or access sensitive runtime configuration.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The documentation explicitly instructs users to paste an NCBI API key and email into the chat. Chat channels are not an appropriate secret-handling mechanism because credentials may be logged, retained, visible to operators, or exposed to downstream tooling, creating unnecessary secret collection beyond the core literature lookup task.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README advertises activation via very broad natural-language phrases like 'find the latest research on XX,' which can overlap with ordinary conversation and increase the chance of accidental skill invocation. In an agent ecosystem, ambiguous triggering can route user content to this skill unexpectedly, causing unintended network access and disclosure of sensitive medical topics in prompts.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Telling users to 'just describe your need in plain language' leaves the activation boundary unclear and reinforces permissive matching behavior. That ambiguity can cause over-triggering during normal medical conversations, leading the agent to perform external PubMed queries when the user did not explicitly request tool use.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The English guidance repeats the same broad plain-language activation model, expanding the ambiguity to another language surface and increasing the likelihood of accidental triggering. In a medical-literature context, this can expose sensitive health interests or waste resources through unintended external lookups.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The guide tells users to submit both email and API key directly in the conversation and provides no warning about credential exposure. This increases the chance of secret leakage through logs, transcripts, analytics, support review, or prompt injection chains, and it normalizes unsafe handling of credentials.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.