Disease Investigation Zhcn

PassAudited by ClawScan on May 13, 2026.

Overview

This instruction-only disease-research skill is generally coherent, but it relies on a PatSnap MCP connection/API key and performs a small automatic connectivity check before answering.

This skill appears benign and instruction-only. Before installing, make sure you are comfortable adding the PatSnap MCP server, storing/using a PatSnap API key, and sending disease, drug, patent, or commercial research questions to external services. Use a revocable key and avoid entering confidential or patient-identifying information unless approved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your PatSnap account/API key will be used for queries, and the key may be stored in the MCP configuration or exposed in local command history.

Why it was flagged

The skill asks the user to create and configure a PatSnap API key, giving the MCP service access under the user's PatSnap account. This is disclosed and purpose-aligned, but it is sensitive credential use.

Skill content
登录 https://open.patsnap.com ,进入 **API Keys**,创建一个新 Key。 ... claude mcp add --transport http pharma_intelligence "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx"
Recommendation

Use a scoped/revocable API key if available, avoid sharing command logs containing the key, and revoke or remove the MCP configuration when no longer needed.

What this means

The agent may make a PatSnap MCP request before answering and may perform multiple fetches during a research workflow, which could consume API quota or reveal research topics to the provider.

Why it was flagged

The skill instructs the agent to make MCP calls automatically, including a pre-query connectivity check and potentially bulk fetching up to 100 results. The calls appear read-only and bounded, but they are automated tool use.

Skill content
每次技能加载后、处理任何用户查询之前,必须先执行以下自检。 ... 使用 `ls_target_fetch` 按名称查询 EGFR ... 若 `_search` 工具返回结果不超过 100 条 ... 必须使用全部搜索结果 ID 调用 `_fetch`
Recommendation

Confirm you are comfortable with automatic read-only MCP lookups and monitor API usage if your PatSnap plan has limits.

What this means

Sensitive research interests, pipeline questions, or business-development topics may be sent to PatSnap MCP services and, in some cases, search providers.

Why it was flagged

The skill routes disease, drug, patent, and commercial research queries to an external MCP service and may later use web search. This is aligned with the skill's purpose, but it creates a third-party data boundary.

Skill content
优先使用生命科学 MCP 服务进行数据检索,仅在 MCP 无法满足需求时才考虑其他来源。 ... 网络搜索可根据需要多次调用
Recommendation

Avoid including confidential strategy, patient-identifying information, or proprietary details unless your organization approves use of those external services.