Mfds Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 0.1.0

Overview

This MFDS public API CLI is mostly coherent, but its unrestricted endpoint override can send the user's API key and medication-related search terms to any URL.

Review this before installing if an agent might pass untrusted arguments. Use only the default data.go.kr HTTPS endpoints, avoid --endpoint unless you fully trust the destination, and do not put patient identifiers in drug or ingredient search fields. Consider rotating the MFDS key if it was ever used with a non-MFDS endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: bin/_mfds_common.sh:45

Finding

Unrestricted Endpoint Override Exposes API Credentials and Sensitive Query Data

Content

View full analysis

Vulnerability Details

File Location: bin/_mfds_common.sh:45-47, 96; affected call sites include bin/drug.sh:33-47, bin/drug-easy.sh:33-49, bin/dur.sh:53-65, and bin/recall.sh:29-42
Vulnerability Type: Arbitrary destination credential forwarding and insecure transport
Risk Level: High

Vulnerable Code

The shared argument parser accepts an arbitrary endpoint:

bash

--endpoint)         ENDPOINT="$2"; shift 2 ;;

The shared request function sends the complete query string to that endpoint:

bash

local body
body="$(curl -fsSL --max-time 30 "${url}?${qs}")" || {
  echo "mfds-cli: request failed for $url" >&2
  exit 1
}

Every command constructs its URL from the unrestricted override and includes the API key in the query. For example, the DUR command contains:

bash

URL="${ENDPOINT:-https://apis.data.go.kr/1471000/DURPrdlstInfoService03/$SUB}"

QS="$(mfds_qs \
  "serviceKey=$KEY" \
  "pageNo=$PAGE" \
  "numOfRows=$ROWS" \
  "type=json" \
  "itemName=${NAME}" \
  "ingrName=${INGREDIENT}" \
  "typeName=${TYPE_NAME}" \
)"

mfds_request "$URL" "$QS" "dur"

The other wrappers follow the same pattern:

bash

URL="${ENDPOINT:-https://apis.data.go.kr/...}"

QS="$(mfds_qs \
  "serviceKey=$KEY" \
  ...
)"

mfds_request "$URL" "$QS" "<record-type>"

Technical Analysis

The --endpoint option accepts any URL without validating its scheme, hostname, port, or trust relationship. The commands then automatically append the MFDS API key and all supplied search parameters to that URL.

This permits an untrusted endpoint to receive:

• The user's MFDS_API_KEY.
• Drug and ingredient search terms.
• DUR queries that may expose health-related medication context.
• Product, manufacturer, and business-registration filters.

Because non-HTTPS URLs are not rejected, the same information can also be exposed through interception or modification on an untrusted network.

The arbitrary endpoint additionally creates a data-integrity pr ...[truncated 2403 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the endpoint override if it is not essential. Fixed official MFDS HTTPS endpoints provide the strongest least-privilege design.

2. If overrides are required, enforce an explicit allowlist. Parse the URL and require:

   • Scheme exactly equal to https.
   • Hostname exactly equal to apis.data.go.kr.
   • No embedded username or password.
   • No URL fragment.
   • Only the expected port.
   • A path matching an approved MFDS service prefix.

3. Do not forward MFDS_API_KEY to nonstandard destinations. If development against a custom server is necessary, require a separate explicit test credential and a clearly named unsafe-development option.

4. Fail closed on validation errors. Do not silently accept malformed URLs, redirects to untrusted hosts, or unsupported schemes.

5. Constrain redirects. Since curl -L follows redirects, validate redirect destinations or disable redirects unless required. A trusted initial endpoint must not be allowed to redirect the credential-bearing request to an untrusted host.

6. Reduce credential exposure in URLs where supported. Prefer an authorization header when the upstream API supports one. If MFDS requires a query parameter, ensure URLs are not logged and sanitize error reporting.

7. Separate request data by sensitivity. Warn users that medication names are transmitted to MFDS and advise against including patient names or other identifying data in search fields.

8. Authenticate data provenance where practical. Restricting the destination to the official HTTPS host is essential because normalized output may feed medication-safety decisions.

9. Add regression tests confirming rejection of:

   • http:// endpoints.
   • Lookalike domains such as apis.data.go.kr.attacker.example.
   • URLs with embedded credentials.
   • Unexpected ports.
   • Redirects to external hosts.
   • Arbitrary attacker-controlled domains.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises a CLI that reads an API key from environment variables, invokes shell commands, and performs outbound network requests, but it does not declare any explicit tool scope or permissions metadata. In an agent ecosystem, this creates a trust and policy gap: a host may not be able to enforce least-privilege or present accurate consent for environment access, command execution, and network egress, increasing the risk of secret exposure or unintended external actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The command's user-facing help includes parameter descriptions only in Korean, which can impose a language constraint without user opt-in. There is no indication in this file that the skill is intentionally Korea-only or that alternative language support is available.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script performs an external API request via mfds_request using a query string that includes the service key and user-supplied search parameters. In this file there is no confirmation prompt, disclosure message, or comment warning users that invoking the command will send data to a remote government API endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.