Biomedical Literature Search

• Outcome: Pass
• Latest audit: May 29, 2026, 8:36 PM
• Version:
  1.0.0

Overview

This skill appears to be a straightforward biomedical literature search helper that uses disclosed PubMed and bioRxiv API requests.

Install only if you are comfortable with biomedical search terms, dates, and category filters being sent to PubMed/NCBI and bioRxiv. Avoid confidential project names, unpublished research strategy, or sensitive medical details in queries unless external disclosure is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill demonstrates live network access to PubMed and bioRxiv but does not declare any permissions or capability boundaries. This creates a transparency and governance problem: callers may invoke a skill that can send user-provided queries to external services without an explicit permission model or user awareness.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Fetch papers by date range
url = "https://api.biorxiv.org/details/biorxiv/2026-02-01/2026-03-01"
response = requests.get(url)
papers = response.json()["collection"]

• Confidence: 81% confidence
• Finding: https://api.biorxiv.org/

VirusTotal

67/67 vendors flagged this skill as clean.