Drug Interaction Checker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 0.1.0

Overview

The skill is not malicious, but it gives actionable medication guidance with incomplete safety framing and has avoidable install-time dependency risk.

Review carefully before installing or relying on it. It should not be used as a medical authority: verify any medication decision with a pharmacist or clinician, especially because the database is limited and patient-specific factors are not considered. Install only in an isolated environment, and avoid the documented dependency install unless the package is revised to remove or pin unnecessary requirements.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Related Location: SKILL.md:123-125
Vulnerability Type: Unnecessary, unpinned dependencies and supply-chain exposure
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2:

text

dataclasses
enum

SKILL.md:123-125:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The installation instructions direct users to install dataclasses and enum from the configured Python package index without version constraints or integrity hashes. Both names correspond to functionality available in the Python standard library on supported modern Python versions, and scripts/main.py imports them as ordinary modules:

python

from dataclasses import dataclass, asdict
from enum import Enum

Consequently, the project introduces third-party package installation without a demonstrated runtime need. Python package installation can execute package build or installation hooks. Because neither versions nor hashes are pinned, dependency resolution is mutable and may retrieve different artifacts in future installations.

This finding does not establish that the currently resolved packages are malicious. The vulnerability is the avoidable supply-chain execution channel created by the documented installation procedure.

Attack Path

1. A user follows the prerequisite instructions in SKILL.md.
2. The user runs pip install -r requirements.txt.
3. Pip contacts the configured package index and resolves unconstrained packages named dataclasses and enum.
4. If a resolved release, distribution artifact, package-index account, mirror, or dependency source is compromised, attacker-controlled build or installation logic may execute.
5. That code runs with the privileges of the user or automation account invoking pip.

Impact Assessment

Successful exploitation could provide arbitrary code execution in the installation environment with the ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both entries from requirements.txt when targeting a modern Python version:

   text

   # No external runtime dependencies
   

2. Remove or revise the pip install -r requirements.txt prerequisite in SKILL.md.

3. Declare the minimum supported Python version explicitly, such as Python 3.8 or later.

4. If legacy Python compatibility is genuinely required, use environment markers so backports are installed only where needed.

5. Pin every unavoidable third-party dependency to an audited version and use hashes, for example through a lock file and pip install --require-hashes.

6. Install dependencies from an approved package index or internal mirror in an isolated virtual environment.

7. Add automated dependency and provenance scanning to CI, and periodically review whether each dependency remains necessary.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill generates medication interaction assessments and actionable clinical recommendations before presenting any prominent safety warning in the main CLI/help workflow. In a medical safety-critical context, users may rely on the tool's output as authoritative, and omissions or simplifications in its rule set could lead to harmful self-medication decisions before they see the disclaimer at the end.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents an --output parameter that writes results to a file, and the risk table later notes file-system writes, but there is no direct user-facing warning near usage or parameters about creating or overwriting files. For a clinical tool handling potentially sensitive medication data, an explicit disclosure would better inform users about data being saved to disk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Static analysis

No suspicious patterns detected.