ClawHub
Back to skill

Security audit

生物技术管线全景研究（Biotech Pipeline Landscape）

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it should be reviewed because it can submit proprietary biological sequences for patent FTO work and produce design-around guidance beyond a simple landscape report.

Install only if you intend to use this skill for biotech FTO and product-development research, not just market landscaping. Do not submit confidential sequences unless you are authorized to share them with the configured sequence-search provider, and treat design-around or FTO outputs as preliminary analysis requiring qualified patent counsel review.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The reference materially exceeds the skill’s declared purpose of clinical pipeline and competitive landscape research by providing operational sequence-based FTO screening and manufacturing/QC procedures. This scope expansion creates a capability mismatch that could enable handling of sensitive biological sequences and downstream product-development workflows not justified by the manifest, increasing misuse risk and weakening governance boundaries.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The SOP includes explicit patent design-around guidance at the sequence level, such as targeted CDR substitutions, framework optimization, and alternate scaffold strategies, alongside manufacturing QC methods. In the context of a skill ostensibly limited to market/pipeline landscape analysis, these instructions provide actionable support for circumvention of IP constraints and product engineering, which significantly raises dual-use and compliance risk.

Static analysis

No suspicious patterns detected.