NoahAI drug pipeline

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.6

Overview

This skill coherently uses a disclosed API token to query a fixed drug database endpoint, with some ordinary integration risks to review before use.

Install only if you are comfortable sending drug-search parameters and the NOAH_API_TOKEN to NoahAI's API. Avoid placing the token in chat or command text, use a controlled Python environment with reviewed dependencies, and only use --output for paths you intend to create or overwrite.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/search.py:22

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 22–26
Vulnerability Type: Unpinned third-party dependency and unsafe reproducibility
Risk Level: Medium

Vulnerable Code

python

try:
    import requests
except ImportError:
    print("[ERROR] Missing dependency: requests\nInstall it with: pip install requests", file=sys.stderr)
    sys.exit(1)

The dependency instructions in SKILL.md also direct users to install requests without a version or integrity constraint:

markdown

- `requests` library (`pip install requests`)

Technical Analysis

The Skill depends on the third-party requests package but does not provide a locked dependency manifest, an exact version, or package hashes. The suggested command resolves whichever release the configured Python package index supplies at installation time.

This makes installations non-reproducible and leaves the Skill exposed to supply-chain failures. Exploitation would require a separate compromise or misconfiguration of the package delivery path, such as:

• Compromise of a configured package index or package publisher.
• A malicious private index serving a substituted package.
• User or environment-level pip configuration redirecting installation to an untrusted source.
• A future compromised or vulnerable dependency release being selected automatically.

The reviewed code does not automatically run pip, and requests is a legitimate package rather than an apparent typosquat. Therefore, exploitation is conditional on an operator following the displayed installation instruction and receiving an unsafe artifact from the configured package source.

The Skill's declared network behavior is otherwise consistent with its functionality: it submits user-derived pharmaceutical search parameters and the NOAH_API_TOKEN to the fixed HTTPS endpoint https://www.noah.bio/api/skills/drug_search/. Redirects are disabled, and th ...[truncated 1538 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency lock or requirements file containing an audited exact version, for example:

   text

   requests==<audited-version>
   

2. For stronger artifact integrity, include hashes generated from trusted artifacts and install with hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Pin and review relevant transitive dependencies where the deployment model requires fully reproducible environments.

4. Replace the generic pip install requests message and documentation with installation from the project-maintained lock file.

5. Use an explicitly trusted package index and prevent untrusted user-level or environment-level pip configuration from silently changing the source.

6. Install dependencies inside a dedicated virtual environment under a non-privileged account.

7. Use automated dependency scanning and controlled update review so pinned versions continue receiving security fixes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Tainted flow: 'headers' from os.environ.get (line 84, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 95)May include surrounding context.

python

print(f"[INFO] Query payload:\n{json.dumps(payload, indent=2)}", file=sys.stderr)

    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=30, allow_redirects=False)
        response.raise_for_status()
    except requests.exceptions.ConnectionError as e:
        raise ConnectionError(f"Cannot connect to API server: {api_url}\nDetails: {e}")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core purpose broadly aligns with drug pipeline search: the script queries a drug search backend using fields such as company, drug_name, target, indication, modality, phase, and route_of_administration, then returns matching records. However, the declared description specifically claims automatic parsing of natural-language questions into structured query parameters. The code does not implement any natural-language understanding or parsing; it only accepts preformatted JSON via command-line arguments or a JSON file. This is a material description-behavior mismatch in capability and interface, even though the backend search function itself is consistent with the stated domain.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares access to an environment variable and instructs execution of a Python script that may read/write local files and perform network requests, but it does not define explicit tool scope or allowed tools. In an agent environment, missing least-privilege boundaries increases the chance of unintended file access, token exposure, or network use beyond what reviewers and orchestrators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is broad enough that the skill may activate on general biomedical or business queries containing common words like drug, company, target, or approved. Unintended invocation can cause unnecessary transmission of user query content to an external API and use the NOAH_API_TOKEN in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md

- It requires exactly one environment variable: `NOAH_API_TOKEN`. Store it in the environment or a local `.env` file, and never place it inline in commands, chats, or packaged files.
- The token is scoped to read medical public details only and cannot access private user records.
- The skill does not intentionally persist request parameters locally. Any server-side retention is determined by the NoahAI API service and its operational logging policies.
- It does not request persistent or system-level privileges and does not modify system configuration.
- The skill is source-file based (Python scripts only) and does not require runtime installs, package downloads, or external bootstrap steps.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 95)May include surrounding context.

python

print(f"[INFO] Query payload:\n{json.dumps(payload, indent=2)}", file=sys.stderr)

    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=30, allow_redirects=False)
        response.raise_for_status()
    except requests.exceptions.ConnectionError as e:
        raise ConnectionError(f"Cannot connect to API server: {api_url}\nDetails: {e}")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill allows writing output to any local path supplied via --output, even though the skill's stated purpose is only to query a drug database. In an agent context, arbitrary file write can be abused to overwrite user files, drop content into sensitive locations, or interfere with other tools and workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Arbitrary local file write is not justified by a search-only skill and expands its capabilities beyond its declared function. In a broader agent environment, this increases the attack surface because untrusted query results or prompts could cause the agent to persist data in unintended filesystem locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction to "Prefer English keywords" and to translate non-English terms imposes a language behavior by default. This can conflict with language or locale policy expectations when the user has not opted into translation or English-only handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.