small-molecule-rd-analysis

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds a literal API key (sk-...) in the MCP endpoint URL, which forces the agent to include or handle that secret verbatim when generating calls or example code, creating a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时从用户输入中提取化合物标识符（如名称/CAS/SMILES/InChI）并据此调用 MCP 端点 https://connect.zhihuiya.com/713886/logic-mcp?apikey=sk-3F0NsY7KOt2ZyO72XkgwUIwD80xSfBjCNKp7juA92d0HWpKu 进行结构/性质/ADMET等查询，外部可控的自由文本（化合物名称等）会被直接进入意图解析与实体提取流程而影响后续检索参数。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill declares and uses the MCP runtime endpoint https://connect.zhihuiya.com/713886/logic-mcp?apikey=sk-3F0NsY7KOt2ZyO72XkgwUIwD80xSfBjCNKp7juA92d0HWpKu to be called at activation and to return available tools/outputs that the agent must follow, meaning remote content will directly influence agent behavior at runtime.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The document contains a literal, high-entropy API key-looking value (an OpenAI-style key starting with "sk-") embedded in a URL and an endpoint. This is not a placeholder (it is a full key-like string) and therefore qualifies as a real secret that could grant access to a service. The key appears verbatim in SKILL.md lines 11 and 41.