Biomarker Investigation

Security checks across malware telemetry and agentic risk

Overview

This is a benign PatSnap biomarker research skill, but it requires a PatSnap API key and sends relevant research queries to PatSnap MCP services.

Install this only if you intend to use PatSnap LifeScience MCP services. Use a revocable API key, avoid sharing or committing the MCP URL because it contains the key, and do not submit confidential biomedical, patent, or business research details unless your organization permits that data sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill’s activation criteria are broad enough to match many generic biomarker-related requests, which can cause the agent to load this skill in contexts beyond its intended scope. That matters because the skill then pushes the agent into external MCP-dependent workflows and domain-specific instructions, increasing the chance of inappropriate tool use, unnecessary data access, or user confusion when a simpler or safer response path would have sufficed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup example embeds the API key directly in a command URL, and the document does not explicitly warn users to treat the key as a secret. This encourages copy-paste handling of credentials into shell history, logs, screenshots, or shared config, creating a realistic risk of accidental secret disclosure and unauthorized access to the linked MCP services.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal