company-profiling

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed PatSnap pharmaceutical company profiling helper, with no evidence of hidden persistence, destructive behavior, or unrelated data use.

Install this only if you intend to use PatSnap's life-science MCP service for pharmaceutical company research. Prefer a narrowly scoped or short-lived API key, rotate it if exposed, and be aware that the documented URL-based key may be retained in shell history or MCP configuration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Credential Exposed in MCP Server URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–39 and 77–79
Vulnerability Type: API key exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/Logic-mcp?apiKey=sk-xxxxxxxxxxxx"

The failure guidance repeats the same insecure credential-placement pattern:

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/Logic-mcp?apiKey=YOUR_API_KEY"

Technical Analysis

The setup instructions require users to embed a PatSnap API key in a URL query parameter. HTTPS protects the URL while it is transmitted, but it does not prevent exposure at either endpoint or on the local system.

A URL containing the credential may be retained in:

• Shell command history
• MCP client configuration
• Process arguments or diagnostic output
• Proxy, gateway, and web-server access logs
• Crash reports and support bundles
• Configuration backups or synchronization services

The request is sent to the declared PatSnap service and is necessary for the Skill's external data access. No evidence indicates deliberate credential exfiltration to an unrelated party. Nevertheless, placing a reusable secret in a query string exceeds secure minimum-exposure practices because safer authorization headers or protected secret mechanisms should be used.

Attack Path

1. A user follows the documented setup command and substitutes a real PatSnap API key.
2. The complete URL, including the key, is stored in shell history and potentially in MCP configuration.
3. The URL may also appear in process inspection, debug output, telemetry, proxy logs, or server access logs.
4. A local user, compromised logging system, leaked support bundle, or exposed configuration backup obtains the URL.
5. The attacker extracts the apiKey value and submits authenticated requests to the PatSnap service.
6. The attacker retai ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove API credentials from URL query parameters.
2. Use an Authorization header, such as a bearer token, if supported by the MCP service and client.
3. Prefer the MCP client's protected secret store or environment-variable interpolation rather than placing a literal key in commands or configuration files.
4. If URL-based authentication cannot immediately be removed:
   • Use narrowly scoped and short-lived credentials.
   • Restrict keys by service, account, source, or network where supported.
   • Redact query parameters from client, proxy, gateway, and server logs.
   • Prevent credential-bearing commands from being retained in shell history.
   • Apply restrictive permissions to MCP configuration files.
5. Update both setup examples so users are not instructed to copy an insecure pattern.
6. Document key revocation and rotation procedures for users who may already have followed these instructions.
7. Review existing logs, configurations, backups, and support artifacts for previously exposed keys and rotate affected credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's activation criteria are broad enough to match generic company-information questions, which can cause the agent to invoke this skill in situations where it is not the best fit. In this skill, overbroad routing is more concerning because invocation can lead to external MCP connectivity checks and data retrieval against third-party services, increasing the chance of unnecessary data exposure, unintended tool use, or confused-deputy behavior.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The path-level triggers use vague catch-all wording like 'etc.', leaving scope underspecified and increasing ambiguity in which analysis paths should run. In a tool-using skill, ambiguous routing can cause over-execution, unnecessary external queries, and retrieval of more data than needed for the user's request.

Content

No source excerpt is available for this finding.