Biomarker Investigation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent PatSnap biomarker research helper, but its setup asks users to put an API key directly in a URL command, which can expose the credential locally or in logs.

Review before installing. Use a protected secret mechanism or header-based authentication if PatSnap and your MCP client support it; avoid pasting real API keys into shell commands or URL query strings. If you already configured it this way, consider rotating the key and checking saved MCP configuration and logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

API Credential Exposed Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:33-35 and SKILL.md:67-70
Vulnerability Type: API credential exposure through command-line URL query parameters
Risk Level: Medium

Complete Vulnerable Code Snippets

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/ogic-mcp?apiKey=sk-xxxxxxxxxxxx"

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=YOUR_API_KEY"

Technical Analysis

The setup instructions direct users to substitute a live PatSnap API key into a URL query parameter passed as a command-line argument. Although HTTPS protects the request in transit, it does not prevent local or intermediary disclosure of the complete URL.

The credential may be retained or exposed through:

• Shell command history
• Process command-line inspection
• MCP client configuration
• Application and diagnostic logs
• Telemetry, crash reports, or support bundles
• Reverse-proxy and HTTP access logs that record query strings

Sending authentication material to the declared PatSnap service is consistent with the Skill's remote research functionality. However, placing that material in both a query string and command argument exceeds the minimum exposure necessary for authentication. No evidence in the audited file establishes intentional transmission to an unrelated party.

Attack Path

1. A user replaces the documented placeholder with a valid API key.
2. The user executes the provided claude mcp add command.
3. The command or resulting server URL is retained in shell history, process metadata, MCP configuration, logs, telemetry, or diagnostic output.
4. A local user, log reader, support-system operator, or other party with access to those artifacts obtains the key.
5. The party submits requests to PatSnap using the disclosed credential.
6. The credential remains usable until it expires, is revoked, or is rotated.

Impact

...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place API keys in URL query parameters or literal command-line arguments.
2. Prefer an authorization header supported by the service, such as Authorization: Bearer ....
3. Store the credential in the platform's protected secret store and configure the MCP client to reference it without embedding the value in the URL.
4. If secret-store integration is unavailable, use an environment-variable reference that the client resolves without persisting the expanded value. Avoid examples that encourage users to paste the secret directly into a shell command.
5. Ensure application, proxy, telemetry, and diagnostic systems redact authorization values and URL query strings.
6. Restrict file permissions on MCP configuration files and confirm that exported diagnostics omit credentials.
7. Issue narrowly scoped keys with minimum required permissions and quotas.
8. Document credential expiration, revocation, and rotation procedures.
9. Revoke and rotate any real key previously configured using the documented URL pattern.
10. Correct and consolidate the inconsistent endpoint paths (ogic-mcp versus logic-mcp) so users are not encouraged to troubleshoot by repeatedly exposing credentials in commands or logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description at L003-L015 frames the skill as a biomarker-focused literature and patent search tool. However, the skill guide broadens its role to assessing patent infringement risks and using company, drug, news, and business-development data, which goes beyond a straightforward biomarker literature search implementation.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest emphasizes academic and patent literature search for biomarker queries, and the setup/tooling context is centered on PatSnap MCP services. The separate web-search workflow introduces an additional external retrieval capability not clearly justified by or declared in the manifest scope.

Content

No source excerpt is available for this finding.