Disease Investigation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.0.3

Overview

This disease research skill is purpose-aligned but needs review because it configures a PatSnap API key in a URL and can send broad biomedical queries to an external service.

Review this skill before installing. Use it only if you are comfortable sending biomedical, research, patent, trial, and commercial-intelligence queries to PatSnap services, and avoid submitting regulated health data or confidential business information unless your organization permits it. Prefer a safer credential mechanism than putting an API key in a URL, and rotate any key previously used that way.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: API Credential Exposed Through URL Query Parameters## Vulnerability Details **File Location**: `SKILL.md:39-42` and `SKILL.md:77-82` **Vulnerability Type**: API credential exposure through command-line and URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash claude mcp add --transport http pharma_intelligence \ "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx" ``` The connectivity-error guidance repeats the same insecure configuration pattern: ```bash claude mcp add --transport http pharma_intelligence \ "https://connect.patsnap.com/096456/logic-mcp?apiKey=YOUR_API_KEY" ``` The values shown are placeholders rather than live credentials. However, the instructions explicitly require users to replace them with real API keys in URL query parameters. ### Technical Analysis Placing a secret in a URL can disclose it through multiple secondary channels, including: - Shell command history - MCP client configuration files - Process inspection while the command is running - HTTP client, proxy, gateway, and server access logs - Telemetry, diagnostics, and copied error messages - Screenshots or support bundles containing the configured URL URL query strings are routinely retained and logged as ordinary request metadata. Consequently, TLS protects the URL while it is in transit but does not prevent disclosure through endpoint configuration, local history, or intermediary and server-side logging. The skill also mandates a network connectivity probe before processing every query at `SKILL.md:63-67`. Network access to PatSnap is consistent with the declared research functionality, but repeating the probe for every query is broader than necessary. It increases external request volume and credential use without providing additional capability once connectivity has already been established. ### Attack Path 1. A user follows the documented setup command and substitutes a valid PatSnap API key. 2. The complete URL containing t ...[truncated 1124 chars]
• Remediation: ## Remediation Suggestions 1. Do not place API keys in URLs or literal command-line arguments. 2. Prefer an authorization header supported by the MCP service, such as a bearer token supplied through protected client configuration. 3. If the client supports environment interpolation, reference an environment variable rather than embedding the secret: ```bash export PATSNAP_API_KEY="..." ``` Ensure the value itself is not entered into committed files or exposed in shell tracing. 4. Store credentials in the operating system credential manager, an MCP-supported secret store, or another access-controlled secrets manager. 5. Configure clients, proxies, gateways, and servers to redact authorization values and any legacy `apiKey` query parameter from logs, telemetry, diagnostics, and errors. 6. Restrict credential files to the owning user and document their expected storage location and permissions. 7. Scope API keys to the minimum required services, operations, quotas, and lifetime. Provide documented revocation and rotation procedures. 8. Treat any key previously used in a query string as potentially exposed and rotate it after migrating to secure authentication. 9. Perform the EGFR connectivity probe once during setup or once per session, then retry only after connection failures rather than before every user query. 10. Clearly notify users that research terms are transmitted to the external PatSnap service and advise against submitting confidential or regulated data unless organizational policy permits it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill’s activation criteria are broad enough to match a wide range of ordinary biomedical questions, causing the agent to load this skill in situations the user may not expect. Because the skill then directs use of external PatSnap MCP services, over-broad triggering can unnecessarily expose user queries to third-party systems and alter agent behavior outside the intended niche.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The setup and workflow instruct the agent to use PatSnap MCP services, but the skill does not clearly disclose in the user-facing description that queries may be sent to third-party infrastructure. This creates a privacy and data-governance risk, especially for sensitive medical, research, or commercial questions that users may assume stay within the primary assistant environment.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.