ClawHub
Back to skill

Security audit

Biomedical Patent Trends

Security checks across malware telemetry and agentic risk

Overview

The skill matches its patent-analysis purpose, but its downloader can send the SciMiner API key to any URL returned by the provider response.

Review this before installing if you use a real SciMiner key. The core workflow is disclosed and useful, but the downloader should restrict credentialed requests to SciMiner or approved download hosts, avoid HTTP URLs, and avoid attaching the API key to arbitrary URLs found in service responses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill directs the agent to read local files, write analysis artifacts, and make network requests, but it does not declare corresponding permissions. That mismatch weakens security review and runtime policy enforcement because a reviewer or platform may underestimate the skill's actual access needs.

Credential Access

High
Category
Privilege Escalation
Content
name: biomedical-patent-trends
description: Download, search, and analyze Patent-Mol-Wiki biomedical-patent packages. Use when users ask what happened in a recent patent period, need portfolio or trend statistics from wiki index.md files, ask whether a target, disease, modality, organization, or patent is present, need charts of patent distributions, or need molecular-structure analysis from selected patent folders.
credential_files:
  - ~/.config/sciminer/credentials.json
---

# Biomedical Patent Trends
Confidence
92% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
## SciMiner credential prerequisite

1. Obtain a SciMiner API key from `https://sciminer.tech/utility`.
2. Store it outside this repository at `~/.config/sciminer/credentials.json` as `{"api_key":"your_api_key_here"}`.
3. For every SciMiner call, read the `api_key` field from that file and send it as the `X-Auth-Token` header.
4. Never request, print, persist, or write the key in prompts, logs, output artifacts, or repository files. Remember only the credential-file path.
Confidence
90% confidence
Finding
credentials.json

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.