ClawHub
Back to skill

Security audit

biomarker-investigation

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its biomarker research purpose, but its setup asks users to persist a PatSnap API key inside an MCP URL, which can expose the key through command history, config, or logs.

Review this before installing if the PatSnap API key grants access to sensitive or paid data. Prefer a limited-scope key, rotate any key previously placed in a URL, and use a safer secret mechanism if PatSnap or the MCP client supports one.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:34
Finding

API Key Exposed Through MCP URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–36 and 74–76
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash
claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/Logic-mcp?apiKey=sk-xxxxxxxxxxxx"

The same insecure pattern is repeated in the connection-error guidance:

bash
claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/Logic-mcp?apiKey=YOUR_API_KEY"

Technical Analysis

The setup instructions require users to embed a PatSnap API key directly in the MCP server URL. Although the endpoint uses HTTPS and therefore encrypts the request in transit, placing credentials in a URL query string creates additional exposure surfaces. The complete URL may be retained in:

  • Shell command history
  • Process command-line metadata
  • MCP client configuration files
  • Proxy and server access logs
  • Diagnostic output, telemetry, and error reports
  • Screenshots or copied setup commands

Authentication to the declared PatSnap service is necessary for the Skill's biomarker and patent research functionality. However, exposing the credential through a query parameter is not the minimum-risk authentication mechanism. The service must receive an authentication secret, but unrelated local users, logging systems, and infrastructure components do not need access to it.

The visible sk-xxxxxxxxxxxx value is an example placeholder rather than a confirmed live secret. The vulnerability arises because the documentation directs users to replace it with a real credential while retaining the insecure URL-based transport pattern.

Attack Path

  1. A user follows the setup instructions and substitutes a valid PatSnap API key into the URL.
  2. The complete command or resulting URL is retained in shell history, process metadata, an MCP configuration file, or infrastructure logs.
  3. An attacker with access to ...[truncated 1048 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not place API credentials in URL query parameters.
  2. Prefer an MCP client secret field, protected environment variable, operating-system credential store, or dedicated secret manager.
  3. Transmit the key through an authorization header, such as Authorization: Bearer ..., where supported.
  4. Ensure secret-bearing configuration files use restrictive filesystem permissions and are excluded from source control.
  5. Redact credentials from client errors, telemetry, debug traces, and server or proxy logs.
  6. Avoid displaying real keys in terminal commands where process inspection or shell-history capture is possible.
  7. Rotate any API key previously configured using the documented URL pattern and review relevant logs for unintended disclosure.
  8. If the service currently accepts authentication only through query parameters, update the service and MCP integration to support header-based or protected client-side credential injection.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md
**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |