Precision Oncology

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.3

Overview

The skill appears purpose-built for oncology research, but it needs review because it sends sensitive medical queries to external services and documents risky API-key handling.

Install only if you are comfortable sending oncology research queries to PatSnap and, when web search is triggered, to search providers. Avoid entering patient names, record numbers, exact dates, or other identifying details. Prefer a safer credential setup if PatSnap supports headers, environment secrets, or a credential store instead of an apiKey URL parameter, and rotate any key that may have been exposed in command history or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

API Credential Exposed Through a URL Query Parameter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-38; repeated at SKILL.md:76-78
Vulnerability Type: Credential exposure through insecure configuration
Risk Level: Medium

Vulnerable code:

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx"

The same pattern is repeated in the connection-error guidance:

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=YOUR_API_KEY"

Technical Analysis

The documented setup procedure instructs users to place a PatSnap API key directly in a URL query parameter. The included values are placeholders rather than confirmed live credentials, but users are expected to replace them with real credentials.

HTTPS protects the URL while it is in transit, but it does not prevent local or endpoint-side disclosure. A URL containing a credential can be retained in:

• Shell command history
• Process argument listings
• MCP client configuration
• Application, proxy, gateway, and diagnostic logs
• Telemetry and support bundles
• Screenshots or copied configuration output

Query parameters are also more likely than authorization headers to be logged without redaction. This is an insecure secret-handling pattern and violates credential-minimization practices.

Attack Path

1. A user follows the setup instructions and replaces the placeholder with a valid API key.
2. The complete command and credential-bearing URL are saved in shell history, process metadata, client configuration, or logs.
3. A local user, administrator, support operator, telemetry recipient, or compromised logging system obtains the URL.
4. The exposed API key is extracted from the apiKey parameter.
5. The attacker reuses the key against PatSnap services until the credential is revoked or expires.

Impact Assessment

Successful ...[truncated 372 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place API credentials in URL query parameters.
2. Pass the key through an Authorization header or another provider-supported authenticated header.
3. If the MCP client supports secret references, store the key in an operating-system credential store or dedicated secret manager and reference it without expanding it into the command line.
4. If an environment variable is required, ensure it is supplied to the process without printing it, and restrict access to the environment and configuration files.
5. Configure clients, proxies, telemetry systems, and support bundles to redact authorization material.
6. Warn users not to commit credential-bearing configuration or share diagnostic output containing connection URLs.
7. Document key rotation and revocation procedures for potentially exposed credentials.

other

Note

• Location: SKILL.md:60

Finding

Mandatory Unrelated External Connectivity Request for Every Loaded Query

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:60-64
Vulnerability Type: Excessive external network access
Risk Level: Low

Vulnerable code:

text

**Before processing any user query after this skill loads, the following connectivity check MUST be performed.**

1. Probe MCP connectivity with a lightweight tool call, e.g. query the known target `EGFR`:
   - Use `ls_target_fetch` to look up EGFR by name
   - If valid data is returned → MCP is connected, proceed to the user's query

Technical Analysis

The Skill mandates a PatSnap request before processing every user query after the Skill loads. The fixed EGFR lookup is unrelated to many valid oncology questions and is not required merely to determine whether an external lookup is necessary.

This behavior exceeds minimum privilege because it exercises external network access even when the current request could be answered without PatSnap or does not concern EGFR. It also creates recurring disclosure of request timing and Skill usage to the service. The subsequent instruction to stop when the check fails makes the external service an unnecessary availability dependency for all covered queries.

A connectivity check can be legitimate when the requested operation requires the service. The risk arises from making the check unconditional and performing a substantive domain lookup instead of a cached or dedicated health check.

Attack Path

1. The Skill is loaded for an oncology-related request.
2. Before evaluating whether external data is necessary, the agent sends an EGFR lookup to PatSnap.
3. PatSnap and relevant network intermediaries observe the request metadata, source, and timing.
4. The same process recurs for subsequent Skill activations or queries.
5. If the service is unavailable or access is revoked, the instructions force the agent to stop even where the underlying question might otherwise be answerable.

Impact Assessment

T ...[truncated 353 chars]

Remediation

View remediation

Remediation Suggestions

1. Perform a connectivity check only when the current task actually requires PatSnap data.
2. Cache successful connectivity status for an appropriate session duration rather than probing before every query.
3. Use a dedicated, lightweight health endpoint instead of retrieving an unrelated EGFR record.
4. Allow requests that do not need external data to proceed when PatSnap is unavailable.
5. Document when network access occurs and provide users with a way to decline external retrieval.
6. Apply reasonable timeout, retry, and rate-limit controls to avoid repeated network activity.

other

Warning

• Location: SKILL.md:338

Finding

Potential Disclosure of Identifiable Oncology Queries to External Search Providers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:338-341, in conjunction with the web-search rules at SKILL.md:302-313
Vulnerability Type: Sensitive medical information disclosure
Risk Level: Medium

Vulnerable code:

text

**Query Construction:**

- **First turn**: Use the user's original question as the search query
- **Multi-turn dialogue**: Synthesize context from the full conversation into an effective search query
- **Language preservation**: Keep the user's language preference in the query

The transmission rule applies when the Skill determines that web search is needed, including when database results are insufficient or the user requests current information.

Technical Analysis

The Skill handles oncology questions, which can contain sensitive health information such as diagnoses, genomic variants, age, location, treatment history, trial participation, or patient names. It instructs the agent to use the original question as the first web-search query and to synthesize the full conversation during later turns.

No instruction requires removal of direct identifiers, quasi-identifiers, or unnecessary clinical details before transmission. There is also no requirement to obtain consent or warn the user that query content may be sent to a third-party search provider.

The web-search step is conditional rather than universal. Nevertheless, when triggered, the prescribed raw-query behavior can disclose substantially more information than is necessary to retrieve public medical literature. A minimized query containing only the disease, intervention, target, and recency requirement would generally be sufficient.

Attack Path

1. A user submits an oncology question containing identifiable or sensitive patient information.
2. PatSnap results are considered insufficient, or the user requests current or recent information.
3. The Skill activates web search according to its retrieval rules.

...[truncated 780 chars]

Remediation

View remediation

Remediation Suggestions

1. Never forward a user's original medical question verbatim by default.
2. Extract only the minimum non-identifying concepts required for retrieval, such as disease, molecular target, therapy, study phase, region, and requested date range.
3. Remove names, contact details, record numbers, exact dates, precise locations, and unique combinations of demographic or clinical attributes.
4. Do not synthesize external queries from the full conversation unless every included detail is necessary and non-identifying.
5. Clearly notify the user before transmitting query content to an external provider and obtain consent where sensitive information may be involved.
6. Provide a mode that disables web search and relies only on approved data sources.
7. Define retention, logging, and data-processing expectations for every external provider.
8. Add an automated sensitive-data inspection and redaction step before all external tool calls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's activation criteria are very broad, covering generic topics like cancer, tumour, carcinogenesis, and treatment. This can cause the skill to load for a wide range of common biomedical queries, increasing the chance of unnecessary external data access, over-collection, or routing users into a specialized workflow when a simpler or safer response would suffice.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The instruction to keep the user's language preference implies a language policy, but the file does not clearly state how that preference is determined or offer an explicit opt-in choice. This can create a locale-handling policy ambiguity in organizational settings where explicit language selection is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.