maccabi-pharm-search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 2.0.0

Overview

The skill does what it says: it runs a Node.js helper to query Maccabi pharmacy stock, with no evidence of hidden persistence, credential access, or unrelated behavior.

Install from a pinned or inspected source when possible, and avoid running the npx installer with elevated privileges. Before using the skill, understand that drug names and city codes you search are sent to Maccabi's public web service and may reveal health-related interests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:23-26
Vulnerability Type: Unpinned package execution and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

npx skills add alexpolonsky/agent-skill-maccabi-pharm-search

Technical Analysis

The documented installation procedure invokes the third-party skills package through npx without specifying a reviewed version or integrity value. If the package is not already installed locally, npx can retrieve its current release from the configured package registry and execute it.

Consequently, the code executed during installation is not limited to the content audited in this repository. A later package release, compromised publisher account, or compromised package distribution channel could alter the effective installation payload without any changes to this project.

No evidence indicates that the currently published dependency is malicious. The vulnerability is the absence of version and integrity controls around executable third-party installation tooling.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or another component responsible for the package resolved as skills.
2. The attacker publishes a modified release containing malicious installation behavior.
3. A user follows the README and runs the unpinned npx skills add ... command.
4. npx resolves and downloads the attacker-controlled package release.
5. The malicious package executes with the privileges of the user running the installation command.

Impact Assessment

Successful exploitation permits code execution under the installing user's account. Depending on that account's privileges and environment, the malicious installer could read or modify user-accessible files, steal credentials available to the process, alter installed agent skills, or establish persistence.

The project itself does not request elevated pri ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer package to a specifically reviewed version, for example by using the equivalent of npx skills@<reviewed-version> ....
• Use package-manager integrity and lockfile controls where the installation workflow supports them.
• Document how users can verify the package name, version, publisher, and integrity before execution.
• Prefer the documented Git clone installation method as the default because it permits users to inspect and pin a specific repository commit.
• If npx remains supported, advise users not to run the installation command with administrator or root privileges.
• Periodically review the pinned installer release before updating the documented version.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/pharmacy-search.js:31

Finding

Unbounded and Timeout-Free HTTPS Response Handling

Content

View full analysis

Vulnerability Details

File Location: scripts/pharmacy-search.js:31-55
Vulnerability Type: Resource exhaustion through unrestricted network response buffering
Risk Level: Low

Vulnerable Code

javascript

const req = https.request(requestOptions, (res) => {
  let data = '';
  res.on('data', (chunk) => data += chunk);
  res.on('end', () => {
    if (data.startsWith('<!DOCTYPE') || data.startsWith('<html')) {
      resolve({ error: 'HTML_RESPONSE', message: 'Received HTML instead of JSON.' });
      return;
    }

    try {
      resolve(JSON.parse(data));
    } catch (e) {
      resolve({ error: 'INVALID_JSON', message: 'Invalid JSON response', raw: data.substring(0, 200) });
    }
  });
});

req.on('error', (err) => reject({ error: 'NETWORK_ERROR', message: err.message }));

if (options.body) {
  req.write(JSON.stringify(options.body));
}
req.end();

Technical Analysis

The request helper appends every response chunk to an in-memory string without enforcing a maximum response size. A sufficiently large response can therefore consume excessive process memory. The code also sets neither a request timeout nor a socket timeout, allowing an endpoint that sends no response, or sends data indefinitely, to keep the process active.

In addition, the callback does not validate the HTTP status code before buffering and parsing the response. Error pages and unexpected responses are therefore processed through the same unrestricted buffering path.

Exploitation over the network is constrained because the application connects to a fixed HTTPS host. A practical attacker would generally need to compromise the upstream service or its infrastructure, redirect traffic while presenting a certificate accepted for the target host, or otherwise control a trusted response path. An accidental upstream malfunction could trigger the same denial-of-service condition without malicious ...[truncated 1271 chars]

Remediation

View remediation

Remediation Suggestions

• Configure explicit request and socket timeouts and destroy the request when a timeout occurs.
• Track received bytes and abort the response when a conservative maximum JSON response size is exceeded.
• Validate res.statusCode before buffering the response and reject responses outside the expected successful range.
• Optionally validate the response Content-Type before parsing it as JSON.
• Handle response-stream errors with res.on('error', ...).
• Return structured timeout, response-size, and HTTP-status errors to callers.
• Ensure cleanup settles the promise only once after the request or response has been aborted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install the skill via npx skills add ... without pinning a specific version of the skills package. Because npx resolves and executes the latest matching package at runtime, a compromised upstream package, typo-squatted dependency, or malicious future release could result in arbitrary code execution on the user's machine during installation. In the context of an agent skill, installation commands are likely to be copied and run directly, which increases practical risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and demonstrates execution of a Node.js script that queries external APIs, but the manifest does not declare any tool scope such as explicit permissions or allowed tools. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot easily tell that network access and code execution are required, which can lead to unintended outbound requests or broader execution than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill sends user-supplied medication names and city codes to a third-party healthcare-related service without any privacy notice, consent flow, or data-handling warning. In this context, medication searches can reveal sensitive health interests, and even though the transport is HTTPS, undisclosed transmission of health-related queries can expose users to privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.