Company Profiling

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.3

Overview

The skill’s pharma-company research workflow is coherent, but its setup tells users to put an API key in a URL command that can be saved in logs or shell history.

Review the API-key handling before installing. Prefer a configuration method that keeps the PatSnap key in a protected secret store or environment variable, and rotate any real key already pasted into a shell command, logs, screenshots, or shared support output. Also expect company, drug, patent, and deal queries to be sent to PatSnap MCP services and sometimes to web search.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

API Credential Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–38
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx"

A corresponding user-facing command containing apiKey=YOUR_API_KEY is repeated at lines 76–78.

Technical Analysis

The setup instructions require placing a PatSnap API key directly in a URL query string passed as a command-line argument. Although the documented value is a placeholder rather than a live credential, following the instructions with a real key can expose that key through:

• Shell history files
• Process command-line listings
• MCP client configuration or diagnostic output
• Application, reverse-proxy, access, and monitoring logs
• Error reports and copied terminal output
• URL telemetry or request tracing

HTTPS encrypts the URL while it is transmitted, but it does not prevent disclosure at the client, process, logging, or server infrastructure layers. The same unsafe credential pattern appears again in the connectivity-failure guidance at lines 76–78.

Attack Path

1. A user follows the setup instructions and substitutes a real PatSnap API key into the URL.
2. The complete command and credential-bearing URL are recorded in shell history, process arguments, configuration, or operational logs.
3. A local user, support operator, log reader, or attacker with access to one of those records extracts the API key.
4. The attacker submits requests to the PatSnap service using the exposed key.
5. The attacker can consume API quota and access data or operations authorized to that key until it is revoked, rotated, or expires.

Impact Assessment

Exploitation does not itself grant host-level privilege escalation. Its scope is bounded by the permissions assigned to the exposed PatSnap API key. Potential effects include:

...[truncated 338 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place API keys in URL query parameters.
2. Prefer an Authorization header or another MCP-supported secret-bearing header:

   text

   Authorization: Bearer <API_KEY>
   

3. Load the credential from a protected environment variable, operating-system credential store, or dedicated secrets manager rather than accepting it as a literal command-line value.
4. Ensure the MCP client stores credentials separately from ordinary configuration and redacts them from logs, diagnostics, errors, and status output.
5. If the service only supports query-string authentication, construct the URL internally from protected secret storage and prevent it from appearing in command history or process listings.
6. Update both occurrences of the setup command, including the failure guidance at lines 76–78.
7. Document credential rotation, revocation, minimum-scope permissions, expiration, and incident-response procedures.
8. Advise users to rotate any key previously entered into a shell command or retained in logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s invocation description is broad enough to match generic questions about pharmaceutical companies, which can cause the skill to activate when the user did not intend to use a PatSnap-backed profiling workflow. This increases the chance of unnecessary external data access and over-collection of user query context, especially in environments where tool invocation carries privacy, cost, or data-governance consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup example places the API key directly in a shell command URL, which encourages users to paste live credentials into command history, terminal logs, screenshots, and shared documentation. Even though the example uses a placeholder, the pattern normalizes insecure secret handling and can result in credential exposure and unauthorized access to the connected MCP service.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The path trigger phrases are vague and overlap with ordinary analytical requests like 'company profile' or 'capabilities,' which can lead to overbroad routing and activation of unnecessary modules. In practice, this can cause the agent to retrieve more categories of company data than needed, violating least-privilege and increasing the risk of unnecessary external lookups.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.