ClawHub
Back to skill

Security audit

Medical Research Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent biomedical research skill that sends user-chosen research queries to a disclosed external MCP endpoint, with some important medical-use and dependency-installation cautions.

Use this as a research aid only. Do not make diagnosis, treatment, or medication decisions from its output without checking authoritative sources and a qualified clinician. If running locally, prefer a dedicated virtual environment or container, pin and verify the `medical-mcps` package version, and avoid exposing unnecessary API keys or sensitive files to that process.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:146
Finding

Unpinned Third-Party Package Is Installed and Immediately Executed

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish and verify cryptographic hashes through a locked requirements file: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Document the authoritative package repository and publisher so users can verify that the package name is legitimate. 4. Review each dependency update before changing the pinned version. 5. Recommend installation in a dedicated virtual environment or isolated container rather than the user's global Python environment. 6. Run the service as a non-privileged account and avoid exposing unnecessary credentials or sensitive files to its process. 7. Where feasible, provide reproducible builds, signed release artifacts, provenance attestations, and a software bill of materials. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill provides biomedical and drug-safety research workflows but does not clearly warn that outputs are informational research data and not medical advice. In a medical context, omission of this boundary can cause users to over-trust tool output for diagnosis, treatment, or medication decisions, increasing risk of harmful real-world misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash
# Find drugs for myasthenia gravis
curl -X POST https://mcp.cloud.curiloo.com/tools/unified/mcp \
  -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"chembl_find_drugs_by_indication","arguments":{"indication":"myasthenia gravis","max_results":10}},"id":1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

bash
# Search multiple targets
for gene in CHRNE RAPSN LRP4; do
  curl -X POST https://mcp.cloud.curiloo.com/tools/unified/mcp \
    -H "Content-Type: application/json" -H "Accept: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"chembl_find_drugs_by_target\",\"arguments\":{\"target_name\":\"$gene\",\"max_results\":10}},\"id\":1}"
  sleep 1  # Be nice to the API

Rp1

Low
Category
MCP Rug Pull
Confidence
60% confidence
Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.