ClawHub
Back to skill

Security audit

target-intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent PatSnap life-science research assistant, but its setup example handles the API key in a way users should treat carefully.

Before installing, understand that this skill connects your agent to PatSnap MCP services using your PatSnap API key. Avoid pasting a real key into shared terminals, logs, screenshots, or recorded sessions; rotate the key if it may have been exposed. Review the added MCP configuration and remove it when you no longer need the integration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The setup command embeds the API key directly in a shell command and URL query string, which increases the risk of secret leakage through shell history, process listings, logs, screenshots, clipboard sharing, or terminal recordings. In a skill that explicitly instructs users to configure remote MCP connectivity, this context makes the exposure more dangerous because users are likely to copy-paste the example verbatim during setup.

Static analysis

No suspicious patterns detected.