maccabi-pharm-search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 2.0.0

Overview

The skill does what it says: it runs a Node.js helper to query Maccabi pharmacy stock, with no evidence of hidden persistence, credential access, or unrelated behavior.

Install from a pinned or inspected source when possible, and avoid running the npx installer with elevated privileges. Before using the skill, understand that drug names and city codes you search are sent to Maccabi's public web service and may reveal health-related interests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Unpinned Third-Party Package Execution During Installation## Vulnerability Details **File Location**: `README.md:23-26` **Vulnerability Type**: Unpinned package execution and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add alexpolonsky/agent-skill-maccabi-pharm-search ``` ### Technical Analysis The documented installation procedure invokes the third-party `skills` package through `npx` without specifying a reviewed version or integrity value. If the package is not already installed locally, `npx` can retrieve its current release from the configured package registry and execute it. Consequently, the code executed during installation is not limited to the content audited in this repository. A later package release, compromised publisher account, or compromised package distribution channel could alter the effective installation payload without any changes to this project. No evidence indicates that the currently published dependency is malicious. The vulnerability is the absence of version and integrity controls around executable third-party installation tooling. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or another component responsible for the package resolved as `skills`. 2. The attacker publishes a modified release containing malicious installation behavior. 3. A user follows the README and runs the unpinned `npx skills add ...` command. 4. `npx` resolves and downloads the attacker-controlled package release. 5. The malicious package executes with the privileges of the user running the installation command. ### Impact Assessment Successful exploitation permits code execution under the installing user's account. Depending on that account's privileges and environment, the malicious installer could read or modify user-accessible files, steal credentials available to the process, alter installed agent skills, or establish persistence. The project itself does not request elevated pri ...[truncated 224 chars]
• Remediation: ## Remediation Suggestions - Pin the installer package to a specifically reviewed version, for example by using the equivalent of `npx skills@<reviewed-version> ...`. - Use package-manager integrity and lockfile controls where the installation workflow supports them. - Document how users can verify the package name, version, publisher, and integrity before execution. - Prefer the documented Git clone installation method as the default because it permits users to inspect and pin a specific repository commit. - If `npx` remains supported, advise users not to run the installation command with administrator or root privileges. - Periodically review the pinned installer release before updating the documented version.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/pharmacy-search.js:31
• Finding: Unbounded and Timeout-Free HTTPS Response Handling## Vulnerability Details **File Location**: `scripts/pharmacy-search.js:31-55` **Vulnerability Type**: Resource exhaustion through unrestricted network response buffering **Risk Level**: Low ### Vulnerable Code ```javascript const req = https.request(requestOptions, (res) => { let data = ''; res.on('data', (chunk) => data += chunk); res.on('end', () => { if (data.startsWith('<!DOCTYPE') || data.startsWith('<html')) { resolve({ error: 'HTML_RESPONSE', message: 'Received HTML instead of JSON.' }); return; } try { resolve(JSON.parse(data)); } catch (e) { resolve({ error: 'INVALID_JSON', message: 'Invalid JSON response', raw: data.substring(0, 200) }); } }); }); req.on('error', (err) => reject({ error: 'NETWORK_ERROR', message: err.message })); if (options.body) { req.write(JSON.stringify(options.body)); } req.end(); ``` ### Technical Analysis The request helper appends every response chunk to an in-memory string without enforcing a maximum response size. A sufficiently large response can therefore consume excessive process memory. The code also sets neither a request timeout nor a socket timeout, allowing an endpoint that sends no response, or sends data indefinitely, to keep the process active. In addition, the callback does not validate the HTTP status code before buffering and parsing the response. Error pages and unexpected responses are therefore processed through the same unrestricted buffering path. Exploitation over the network is constrained because the application connects to a fixed HTTPS host. A practical attacker would generally need to compromise the upstream service or its infrastructure, redirect traffic while presenting a certificate accepted for the target host, or otherwise control a trusted response path. An accidental upstream malfunction could trigger the same denial-of-service condition without malicious ...[truncated 1271 chars]
• Remediation: ## Remediation Suggestions - Configure explicit request and socket timeouts and destroy the request when a timeout occurs. - Track received bytes and abort the response when a conservative maximum JSON response size is exceeded. - Validate `res.statusCode` before buffering the response and reject responses outside the expected successful range. - Optionally validate the response `Content-Type` before parsing it as JSON. - Handle response-stream errors with `res.on('error', ...)`. - Return structured timeout, response-size, and HTTP-status errors to callers. - Ensure cleanup settles the promise only once after the request or response has been aborted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to install the skill via `npx skills add ...` without pinning a specific version of the `skills` package. Because `npx` resolves and executes the latest matching package at runtime, a compromised upstream package, typo-squatted dependency, or malicious future release could result in arbitrary code execution on the user's machine during installation. In the context of an agent skill, installation commands are likely to be copied and run directly, which increases practical risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and demonstrates execution of a Node.js script that queries external APIs, but the manifest does not declare any tool scope such as explicit permissions or allowed tools. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot easily tell that network access and code execution are required, which can lead to unintended outbound requests or broader execution than expected.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends user-supplied medication names and city codes to a third-party healthcare-related service without any privacy notice, consent flow, or data-handling warning. In this context, medication searches can reveal sensitive health interests, and even though the transport is HTTPS, undisclosed transmission of health-related queries can expose users to privacy and compliance risk.

Static analysis

No suspicious patterns detected.