Target Intelligence Zhcn

PassAudited by ClawScan on May 13, 2026.

Overview

This appears to be a read-only biomedical intelligence skill that uses PatSnap MCP services with an API key; no malicious behavior is evident, but users should understand the external-service and credential setup.

This skill looks coherent for PatSnap-based target intelligence research. Before installing, make sure you trust the PatSnap MCP endpoint, understand where your API key is stored, and do not submit confidential biomedical or competitive-intelligence questions unless your organization permits that data flow.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Installing users may grant Claude Code access to PatSnap services under their API key, which could affect account usage, quota, billing, or access permissions.

Why it was flagged

The skill requires a PatSnap API key for the remote MCP service. This is expected for the integration, but it is still account-level credential material.

Skill content

登录 https://open.patsnap.com ，进入 **API Keys**，创建一个新 Key ... apiKey=sk-xxxxxxxxxxxx

Recommendation

Use a scoped API key if available, avoid sharing it, rotate it if exposed, and confirm the PatSnap account and API usage terms before connecting.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Confidential target, pipeline, company, or competitive-intelligence questions may be sent to the connected PatSnap MCP service.

Why it was flagged

The skill depends on an external MCP provider for biomedical intelligence retrieval. This is disclosed and aligned with the skill purpose, but user queries and retrieved context may flow through that provider.

Skill content

PatSnap 生命科学 MCP 服务让 Claude Code 直接访问超 2 亿条专利、药物研发及生物数据

Recommendation

Review PatSnap’s privacy and compliance terms and avoid submitting confidential business or research information unless that use is approved.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill may consume API quota or create provider logs even before the user’s substantive query is processed.

Why it was flagged

The skill directs the agent to make an MCP tool call automatically on each load before answering. The call is a lightweight read-only connectivity check, but it is still autonomous external API use.

Skill content

每次技能加载后、处理任何用户查询之前，必须先执行以下自检 ... 使用 `ls_target_fetch` 按名称查询 EGFR

Recommendation

Users concerned about quota or logging should verify MCP connection settings and monitor PatSnap API usage.