ClawHub
Back to skill

Security audit

医药情报简报（Pharma Intelligence Brief）

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed pharma report generator with a local HTML renderer, and I found no hidden data collection, persistence, credential use, or unrelated behavior.

Before installing, be comfortable with the agent using external pharmaceutical intelligence/search tools and running the bundled Python renderer. Keep report outputs in a dedicated workspace folder, and treat the generated brief as monitoring/strategy support rather than medical, legal, or freedom-to-operate advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'out_path' from os.environ.get (line 729, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
today = datetime.now().strftime("%Y%m%d")
        out_path = os.path.join(out_dir, f"pharma_intel_brief_{today}.html")

    with open(out_path, "w", encoding="utf-8") as f:
        f.write(html_content)

    print(f"[OK] 报告已生成：{out_path}")
Confidence
87% confidence
Finding
with open(out_path, "w", encoding="utf-8") as f:

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill instructs the agent to read local reference files and invoke a local renderer script, which implies file read and file execution/write-adjacent capabilities, yet no permissions are declared. This creates a transparency and policy-enforcement gap: an operator may approve or run the skill without realizing it depends on filesystem and possibly network-backed retrieval behavior, increasing the chance of unintended data access or unsafe execution paths.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The contract requires invoking a local Python script via subprocess to render the report, introducing an execution boundary that is broader than simple report generation and creates avoidable risk if the script path, input JSON, or execution environment are compromised. In a skill that mainly aggregates and formats intelligence, mandatory local code execution increases attack surface and can enable unintended file access or arbitrary code execution through the renderer pipeline.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.