Medical Research Toolkit

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a documentation-only guide for querying biomedical databases through a disclosed external MCP endpoint, with normal caution needed for research queries and optional API keys.

This appears coherent and purpose-aligned for biomedical research. Before using it, be aware that the production endpoint is an external service, do not include patient-identifying or confidential data in queries unless appropriate, protect any OMIM API key you provide, and verify the optional Python package if you choose to run the toolkit locally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Medical or research queries entered through the examples may be visible to the external endpoint operator.

Why it was flagged

The skill clearly routes biomedical database queries through a remote MCP endpoint, so that service may receive the user's research terms and request contents.

Skill content
Production (No setup needed): https://mcp.cloud.curiloo.com/tools/unified/mcp ... All 14+ databases unified into one endpoint.
Recommendation

Avoid entering patient-identifying information or confidential research data unless you trust the endpoint and its privacy practices; consider the local option for sensitive work.

What this means

An OMIM API key included in prompts, logs, or remote requests could expose access under the user's OMIM account or quota.

Why it was flagged

OMIM tools require the user to supply an API key as part of the request arguments; this is purpose-aligned but still a credential that should be protected.

Skill content
`api_key` (str): OMIM API key (REQUIRED — get from https://omim.org/api)
Recommendation

Use a dedicated OMIM key where possible, avoid sharing logs containing the key, and rotate the key if it is exposed.

What this means

If a user chooses the local setup path, they will be running third-party package code outside the instruction-only skill.

Why it was flagged

The optional local setup tells users to install and run a package from the Python package ecosystem; it is user-directed and aligned with the skill purpose, but users should verify the package source before running it.

Skill content
Running Locally:
```bash
pip install medical-mcps
medical-mcps
```
Recommendation

Verify the package name, maintainer, repository, and version before installing; prefer a pinned version in controlled environments.