ClawHub
Back to skill

Security audit

生物医药资产估值（Biopharma Asset Valuation）

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent valuation-report skill, but it needs review because its generated HTML report loads third-party JavaScript without clear disclosure and the valuation logic has material formula/disclosure mismatches.

Review before installing. This skill appears designed for legitimate BD valuation work, but use it only if you are comfortable running its local Python report generator, sharing asset assumptions with the configured pharma MCP, and handling generated HTML that loads third-party CDN JavaScript. Prefer disabling HTML output for sensitive reports and treat the valuation output as decision support, not a final investment or deal-price authority.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'md_path' from os.environ.get (line 88, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
# ── MD 报告 ──
    md_path = os.path.join(out_dir, f"bd_valuation_{drug_name}_{ts}.md")
    with open(md_path, "w", encoding="utf-8") as f:
        f.write(result["markdown_report"])
    print(f"[OK] MD报告: {md_path}")
Confidence
90% confidence
Finding
The output path is influenced by an environment variable (`EUREKA_PYTHON_OUTPUT_DIR`) and by untrusted input in `drug_name`, then used in file writes without validation. If an attacker can control either value, they may cause path traversal or arbitrary file creation/overwrite in accessible locations, especially because `os.path.join` does not sanitize `..`, slashes, or absolute-path components embedded in the filename portion.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly instructs reading a local file (`references/real_deals_1394.json`), writing output files under `@session/outputs/`, and executing a script via `python run.py`, which are code-capability behaviors despite no declared permissions. This creates a trust and sandboxing gap: operators may approve or run the skill without understanding that it accesses local data, persists artifacts, and launches code, increasing the risk of unintended data exposure or unsafe execution.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The report and formula claim r-NPV incorporates PoS, but the implemented r-NPV calculation omits the scenario-specific `pos` factor entirely. In a biopharma valuation skill, this can systematically overstate asset values and mislead licensing, negotiation, or investment decisions, especially for early-stage programs where PoS is a major risk driver.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The module claims the report is self-contained and has no external dependencies, but it loads ECharts from a remote CDN at runtime. This creates a supply-chain and privacy risk: opening the generated HTML can trigger network access to a third party, and if the CDN resource is tampered with or unavailable, the report may execute untrusted code or fail to render.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The documentation states that ECharts is embedded locally, but the implementation injects a remote script tag instead. This mismatch can mislead users into opening the file in sensitive environments under the false assumption that no network requests or third-party code execution will occur.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The generated HTML loads ECharts from an external CDN without making that outbound request obvious to the user. In a business context, opening what appears to be a local valuation report can leak access metadata and expose users to third-party script risks without informed consent.

Static analysis

No suspicious patterns detected.