ClawHub
Back to skill

Security audit

precision-oncology

Security checks for vulnerabilities and agentic risk

Overview

This oncology research skill is mostly coherent, but it needs review because it broadly handles sensitive cancer questions while sending user-derived queries to external services and documents API-key use in a URL.

Review before installing if you may ask patient-specific or confidential oncology questions. Use only non-identifying research queries, avoid entering personal medical details, and prefer a safer credential setup if PatSnap supports headers, environment variables, or a secret store instead of putting the API key in the URL.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:35
Finding

API Credential Embedded in MCP Service URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–38; the same pattern is repeated at lines 73–76
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash
claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/Logic-mcp?apiKey=sk-xxxxxxxxxxxx"

Technical Analysis

The setup instructions require users to replace the placeholder with a real API key embedded in the apiKey URL query parameter. Although the endpoint uses HTTPS, which protects the request while in transit, HTTPS does not prevent the complete URL from being exposed through other channels.

The resulting credential-bearing URL may be retained in:

  • Shell command history
  • Claude MCP configuration files
  • Process invocation records
  • Application and diagnostic logs
  • HTTP proxy, gateway, or server access logs
  • Monitoring and error-reporting systems
  • Screenshots or copied support diagnostics

URL query parameters are commonly logged as part of normal operational telemetry. Consequently, this authentication design exposes the API key to more systems and users than are necessary for the Skill's declared oncology-data retrieval functionality. The placeholder itself is not a live secret, but the documented workflow directs users to handle a real secret insecurely.

Attack Path

  1. A user follows the setup instructions and replaces sk-xxxxxxxxxxxx with a valid PatSnap API key.
  2. The full command is retained in shell history, MCP configuration, logs, or diagnostic output.
  3. An attacker or lower-privileged operator obtains access to one of those records.
  4. The attacker extracts the value of the apiKey query parameter.
  5. The attacker submits requests to the PatSnap endpoint using the stolen key.
  6. Requests succeed to the extent permitted by the compromised key until it is revoked, rotated, or expi ...[truncated 512 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place API credentials in URL query parameters.
  • Prefer an Authorization header or another authentication header supported by the service.
  • Load credentials at runtime from an environment variable, operating-system credential manager, or dedicated secret store.
  • Ensure MCP configuration stores only a secret reference rather than the resolved credential where possible.
  • Redact authorization values and sensitive query parameters from client, proxy, gateway, and server logs.
  • Issue narrowly scoped keys with the minimum datasets, operations, and usage limits required by this Skill.
  • Support expiration and routine key rotation, and immediately revoke any key that may have appeared in logs or shell history.
  • Update both occurrences of the setup command so users are not instructed to copy real credentials into command-line arguments.

other

Warning
Location
SKILL.md:339
Finding

Potential Disclosure of Sensitive Oncology Information to External Search Providers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 339–341
Vulnerability Type: External transmission of potentially sensitive health and conversation data
Risk Level: Medium

Vulnerable Code

markdown
**Query Construction:**

- **First turn**: Use the user's original question as the search query
- **Multi-turn dialogue**: Synthesize context from the full conversation into an effective search query
- **Language preservation**: Keep the user's language preference in the query

Technical Analysis

The Skill handles oncology questions, which can contain diagnoses, genetic findings, treatment histories, demographic details, clinical-trial participation, or direct identifiers. The instructions explicitly permit the user's original question and context synthesized from the full conversation to be submitted through a web-search tool.

This behavior lacks required safeguards for:

  • Detecting or removing personal identifiers
  • Minimizing health information included in a query
  • Obtaining informed user consent before external disclosure
  • Restricting searches to general disease and treatment terms
  • Preventing unnecessary inclusion of prior conversation content
  • Warning users that an external search provider may retain their query

External search can be useful for recent oncology information, but transmitting the original question or full conversational context exceeds the minimum information required. A topic-only query—such as a drug name, cancer type, and requested publication period—would ordinarily provide the same research capability without including patient-specific details.

Attack Path

  1. A user asks an oncology question containing personal medical details or identifiers.
  2. The MCP data is considered insufficient or the user requests current information, activating the documented web-search path.
  3. The agent follows the instruction to use the origina ...[truncated 1200 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user consent before sending conversation-derived information to an external web-search provider.
  • Construct minimal, topic-only queries rather than forwarding the original question verbatim.
  • Remove names, contact details, dates of birth, record identifiers, locations, rare demographic combinations, and other identifying attributes.
  • Exclude patient-specific diagnosis, treatment, genomic, and trial information unless strictly necessary and explicitly authorized.
  • Never synthesize a web query from the full conversation without first applying sensitive-data detection and redaction.
  • Prefer MCP databases or approved privacy-preserving sources when they adequately answer the question.
  • Clearly notify users when an external search is necessary and identify the categories of information that will be transmitted.
  • Configure search integrations to minimize logging and retention where provider controls are available.
  • Add a fail-closed rule: if a query cannot be reliably de-identified, do not transmit it externally.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is configured to activate for very broad cancer-related queries, including generic questions about cancer, tumor treatment, and carcinogenesis. This can cause overbroad routing of medically sensitive requests to a specialized skill that may override safer default handling, increase unnecessary tool/API usage, and raise the chance of high-stakes medical or pharmaceutical guidance being produced without tighter scope controls.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |