Pharmaceuticals Exploration Zhcn

PassAudited by ClawScan on May 13, 2026.

Overview

This instruction-only drug research skill is coherent and purpose-aligned, but it requires a PatSnap API key and sends research queries through external MCP services.

Install only if you are comfortable connecting Claude Code to PatSnap MCP services with an API key. Use a dedicated/revocable key, confirm the MCP server URL is the expected PatSnap domain, and avoid submitting confidential drug-development questions unless PatSnap’s data handling is acceptable for your use case.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use the configured PatSnap API key when making pharmaceutical research requests.

Why it was flagged

The skill requires a PatSnap API key and embeds it in the MCP service URL. This is expected for the PatSnap integration, but it gives the agent access to the user’s PatSnap account/API quota.

Skill content

登录 https://open.patsnap.com ，进入 API Keys，创建一个新 Key。 ... "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx"

Recommendation

Use a scoped or dedicated PatSnap API key if possible, avoid sharing the MCP configuration, monitor usage, and revoke the key when no longer needed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Drug, disease, target, and related research queries may be visible to the external PatSnap MCP service.

Why it was flagged

The skill depends on an external MCP provider for data retrieval. This is central to the skill, but user research queries and authentication are routed to that provider.

Skill content

PatSnap 生命科学 MCP 服务让 Claude Code 直接访问超 2 亿条专利、药物研发及生物数据。 ... claude mcp add --transport http pharma_intelligence "https://connect.patsnap.com/096456/logic-mcp?apiKey=..."

Recommendation

Review PatSnap’s privacy and data-handling terms, and avoid sending confidential research questions unless the provider relationship is acceptable.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill may trigger PatSnap API calls before the main answer and may fetch many records for a single query.

Why it was flagged

The skill directs automatic MCP connectivity checks and potentially broad fetches of all returned records. This is aligned with comprehensive research, but it can cause extra provider calls.

Skill content

每次技能加载后、处理任何用户查询之前，必须先执行以下自检。 ... 若 _search 工具返回结果不超过 100 条 ... 必须使用全部搜索结果 ID 调用 _fetch

Recommendation

Be aware of possible quota, cost, and latency impacts; adjust or stop use if the MCP calls are excessive for your account.