T09 · Insecure Skill Coding Practices
Error
- Location
scripts/drug-repurposing-workflow.md:63- Finding
OMIM API Key Disclosed to a Third-Party MCP Proxy
- Content
View full analysis
- Remediation
View remediation
Security audit
Medical Research Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent medical research toolkit, but it needs Review because it routes sensitive biomedical queries and OMIM API keys through a third-party endpoint while giving clinical-style drug-repurposing guidance without clear safety boundaries.
Install only if you are comfortable sending search terms and possibly credentials to the Curiloo MCP service. Do not submit patient-identifying information, private research plans, or real OMIM/OpenFDA keys through the production proxy unless you have reviewed and trust its logging, caching, and retention practices. Treat all drug, trial, safety, and diagnosis-related output as research support only, not medical advice, and validate with primary sources and qualified clinical review. Prefer a pinned, isolated local install or direct official APIs for credentialed sources such as OMIM.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:145- Finding
Unpinned PyPI Package Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
" ``` 2. Publish a requirements or lock file containing exact versions for all transitive dependencies. 3. Include cryptographic package hashes and recommend installation with `--require-hashes`. 4. Identify the expected official PyPI publisher and source repository so users can detect similarly named or substituted packages. 5. Recommend installation inside a dedicated virtual environment or isolated container: ```bash python -m venv .venv . .venv/bin/activate ``` 6. Avoid installation as root or through `sudo`. 7. Add dependency scanning, release-signing, and provenance verification to the publishing process. 8. Re-audit the pinned package and its dependency graph whenever the recommended version changes. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This workflow provides step-by-step guidance for identifying and evaluating drug repurposing candidates for a named disease, including clinical evidence, safety review, and a recommendation template, but it never warns that outputs are for research only and must not be used for diagnosis or treatment decisions. In a medical context, that omission can cause users to over-trust the workflow as decision support, increasing the risk of unsafe self-medication or inappropriate clinical actions based on incomplete or non-validated data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - **Complete SKILL.md** — Getting started guide with quick examples - **6 Database Guides** — PubMed, ClinicalTrials, ChEMBL, OpenTargets, OpenFDA, OMIM - **2 API References** — 8 additional databases + ID mapping - **1 Complete Workflow** — Drug repurposing example with all curl commands ## Quick Start
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This skill provides drug, adverse-event, target, and clinical-trial lookup workflows but does not clearly warn that outputs are for research only and not medical advice. Users may over-trust generated results for diagnosis, treatment selection, or safety decisions, creating a realistic risk of harmful medical misuse in a high-stakes domain.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Find drugs for myasthenia gravis curl -X POST https://mcp.cloud.curiloo.com/tools/unified/mcp \ -H "Content-Type: application/json" -H "Accept: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"chembl_find_drugs_by_indication","arguments":{"indication":"myasthenia gravis","max_results":10}},"id":1}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search multiple targets for gene in CHRNE RAPSN LRP4; do curl -X POST https://mcp.cloud.curiloo.com/tools/unified/mcp \ -H "Content-Type: application/json" -H "Accept: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"chembl_find_drugs_by_target\",\"arguments\":{\"target_name\":\"$gene\",\"max_results\":10}},\"id\":1}" sleep 1 # Be nice to the API
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - Update example query IDs 2. Update [SKILL.md](./SKILL.md): - Add curl example with proper headers - Correct OpenTargets disease ID format 3. Create quick-start examples:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This documentation enables biomedical and drug-repurposing research workflows, including identifying drugs for diseases, screening targets, and checking safety signals, but it does not clearly warn that outputs are research-only and not suitable for diagnosis, treatment selection, or other clinical decision-making. In a medical context, omission of that boundary can cause users to overtrust retrieved database results as actionable medical guidance, especially when the tool aggregates multiple authoritative sources and presents structured workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This documentation enables users to search and retrieve clinical trial details, eligibility criteria, and recruitment information without any warning that the results are informational only and not a substitute for professional medical advice. In a medical-research context, users could misinterpret study listings or trial metadata as treatment guidance or suitability recommendations, creating risk of inappropriate health decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file provides workflow guidance for rare-disease diagnosis and mutation matching using OMIM, but does not warn that results are informational only and not suitable as a standalone clinical or diagnostic basis. In a medical/genetic research skill, this omission can encourage overreliance on tool output for health decisions, especially when the text presents step-by-step diagnostic-like use cases without clinician oversight caveats.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This is a real safety issue because the skill encourages drug safety assessment workflows using FAERS/OpenFDA data, but does not clearly warn that adverse event reports are incomplete, subject to reporting bias, and not sufficient on their own for clinical decision-making. In a medical research context, users may over-interpret counts or apparent trends as evidence of causality or comparative risk, which can lead to unsafe conclusions about a drug’s safety profile.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Query OpenTargets for MG-associated targets
bash curl -X POST https://mcp.cloud.curiloo.com/tools/unified/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0",
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The release notes explicitly promote a live production endpoint and copy-paste curl commands but do not warn users that queries will be sent to an external service. In a medical research context, user queries may contain sensitive research plans, unpublished targets, or potentially regulated health-related data, so the absence of disclosure increases the risk of unintended data transmission.
- Content
Rp1
Low
- Category
- MCP Rug Pull
- Confidence
- 60% confidence
- Finding
pip install without ==version installs the latest release, which could include malicious changes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation encourages use of
include_full_textagainst external public services but does not warn users that their queried PMIDs and search terms may be transmitted to third-party endpoints, and returned content may include copyrighted full text or sensitive biomedical material. In a medical research skill, this can create privacy, compliance, and data-handling risks if users assume retrieval is local or unrestricted.- Content
Static analysis
No suspicious patterns detected.