ClawHub
Back to skill

Security audit

iaiops-pharma

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly disclosed and purpose-aligned, but it advertises a read-only pharma edition while also exposing a high-impact BACnet write operation for live building/cleanroom systems.

Review this skill before installing in any real facility. Treat it as write-capable despite the read-only description, and only enable it where BACnet writes are blocked, separately approved, or intentionally available under formal change control. The monitoring and analysis functions are coherent, but the edition boundary should be corrected before relying on it as read-only.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill manifest explicitly says the edition's tool surface is read-only, but the body later exposes `bacnet_write_property`, which is a real write-capable operation against OT/BMS infrastructure. In a pharmaceutical manufacturing context, this mismatch can cause an agent or operator to authorize the skill under false assumptions and then perform state-changing actions on cleanroom or utility systems, undermining safety and GMP change-control expectations.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
This is the same substantive issue as SDI-1: the documentation promises read-only behavior but later documents an available write operation. For industrial agents, especially in regulated pharma environments, inaccurate claims about non-destructive behavior materially increase risk because downstream automation, reviewers, or users may skip safeguards they would otherwise apply to a write-capable skill.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation guidance says to use the skill whenever a task mentions any of a long list of terms such as 'GMP', 'TOC', 'conductivity', 'CSV', or 'Part 11'. Several of these are broad terms that can appear in many adjacent contexts, and the file does not provide negative examples or explicit boundaries for when the skill should not activate, increasing the chance of unintended invocation.

Static analysis

No suspicious patterns detected.