ClawHub
Back to skill

Security audit

Pharma Csv Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local CSV analyzer, but it materially overstates regulated pharmaceutical compliance capabilities that the included code does not implement.

Review this skill carefully before using it for pharmaceutical quality or regulatory decisions. It appears safe from hidden persistence or malicious code execution, but its compliance and reporting claims exceed the included implementation; use it only as an unvalidated local analysis helper unless the methods, specifications, outputs, and LIMS integrations are independently reviewed and controlled.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This skill makes strong pharmaceutical and regulatory claims—such as OOT detection, GMP-compliant reporting, and USP/EP/ChP checks—that the underlying behavior reportedly does not truly implement. In a pharma QC and regulatory context, users may rely on these claims for batch release, stability decisions, or submissions, creating a serious integrity and compliance risk if incomplete or inaccurate analysis is mistaken for validated domain logic.

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises commands that generate outputs such as PDF reports, which implies file-writing capability, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause the agent runtime or reviewer to underestimate what the skill may write to disk, increasing the risk of unintended file creation or overwrite in regulated environments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation includes sample code that sends batch-analysis results to an external LIMS endpoint using a bearer token, but it does not warn users that potentially sensitive pharmaceutical/QC data is being transmitted off-host or discuss secure credential handling. In a regulated GMP/LIMS context, users may copy this example directly, causing unintended data disclosure, insecure token practices, or noncompliant integrations.

External Transmission

Medium
Category
Data Exfiltration
Content
'status': 'OOS',
            'timestamp': result['analysis_timestamp']
        }
        requests.post(lims_api_url, json=payload, headers=headers)
```

### Automated Pipeline
Confidence
87% confidence
Finding
The example performs an outbound HTTP POST to a LIMS API with batch identifiers, parameter names, values, and timestamps. While this is legitimate functionality, it is still a true external-transmission risk because the skill targets regulated pharmaceutical data and the example lacks safeguards or warnings about approval, minimization, or secure handling of transmitted content.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The module docstrings, CLI help text, status messages, and generated markdown report are written in Chinese only, which imposes a language choice on users without opt-in. The policy specifically calls for flagging locale or language constraints when the skill does not offer a user-selectable language or document a justified regional limitation.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The compliance function advertises USP/EP/ChP-specific checking but applies identical hard-coded assay limits for every selected standard. In regulated pharmaceutical workflows, this can produce materially incorrect compliance conclusions and misleading submission artifacts, especially where standards, products, or methods require different acceptance criteria.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The tool and manifest claim OOS/OOT detection, but the implementation only flags out-of-specification values against fixed limits and never performs out-of-trend analysis. In a pharmaceutical/regulatory context, this can mislead users into believing stability or QC trend excursions are being detected when they are not, creating a compliance and quality risk rather than a code-execution flaw.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The CLI/help text and report language claim 'OOS/OOT' detection even though only OOS detection is implemented. This is primarily an integrity and user-deception issue that can cause operators to rely on nonexistent analytical coverage, which is more concerning in GMP and regulatory use than in casual data tooling.

Missing User Warnings

Low
Confidence
82% confidence
Finding
This code writes the generated report to a user-specified path, which is a file-modifying operation. Although the CLI argument name implies output behavior and a success message is printed afterward, there is no explicit warning, confirmation, or comment near the write path about creating or overwriting a file.

Static analysis

No suspicious patterns detected.