Pharmacoeconomic-evaluation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.4

Overview

The skill appears to be a legitimate pharmacoeconomic analysis toolkit, but users should review it because the install instructions are unpinned and unverified, and the package overstates some capabilities.

Review before installing. Prefer manual installation from this reviewed package or a pinned, verified release instead of the README's `npx` placeholder command. Treat the calculators as basic aids, verify all pharmacoeconomic methods independently, and explicitly set the jurisdiction, threshold, currency, and dependency versions for your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:19-22
Vulnerability Type: Supply-chain risk caused by executing an unpinned remote npm package
Risk Level: Medium

Vulnerable Code

bash

# For Claude Code / CodeBuddy users
npx skills add your-username/pharmacoeconomic-evaluation

Technical Analysis

The documented installation command invokes npx with the unpinned package name skills. If that package is unavailable locally, npx can retrieve it from the configured npm registry and execute its command-line entry point immediately. No exact version, integrity constraint, verified publisher, or reviewed artifact is specified.

Consequently, the code executed during installation can differ from the code that was reviewed. The Skill identifier is also the unresolved placeholder your-username/pharmacoeconomic-evaluation, so the instructions do not establish a verified source identity for the installed Skill.

Exploitation requires the package or dependency resolution path to become malicious or resolve to an unintended component. This could occur through package compromise, registry or configuration manipulation, publisher-account compromise, or substitution of the placeholder Skill source.

Attack Path

1. An attacker compromises or controls the package resolved as skills, one of its installation dependencies, or the repository substituted for the placeholder Skill identifier.
2. A user follows the installation instructions and runs the documented npx command.
3. npx downloads the unresolved package and its dependencies from the configured registry.
4. The downloaded package's executable or lifecycle scripts run with the user's privileges.
5. Malicious code can modify user-accessible files, steal data available to the user, alter the agent's Skill installation, or install attacker-controlled Skill content.

Impact Assessment

Successful exploitation would execute code with the p ...[truncated 499 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace your-username/pharmacoeconomic-evaluation with the exact, verified repository owner and project identifier.
2. Pin the installer to a specific reviewed version rather than allowing npx to resolve the latest release implicitly.
3. Document the expected package publisher, release digest, signature, and official registry.
4. Prefer a download-and-verify workflow that checks a cryptographic checksum or signature before executing installation code.
5. Audit and lock transitive dependencies for the installer and publish reproducible release artifacts.
6. Warn users not to run the installer with administrator or root privileges.
7. Provide a manual installation method from a versioned release as the recommended alternative, allowing users to inspect the files before placing them in the Skills directory.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description significantly overstates the breadth of the skill. While the code is within the general pharmacoeconomic domain and does include a limited sensitivity analysis, its actual purpose is narrow: budget impact analysis. It does not implement the core declared methods such as CEA, CUA, CBA, or decision-analytic modeling frameworks. There is no evidence of comprehensive guidance functionality or specific ISPOR Good Practices support beyond a basic printed report. This is therefore a material description-behavior mismatch due to missing major declared capabilities and a narrower actual scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description overstates the skill substantially. The code does implement several relevant pharmacoeconomic components—ICER, CEAC, one-way sensitivity analysis, Monte Carlo simulation, discounting, QALY calculation, and a basic Markov state transition function—so it is related to the declared domain. However, its actual scope is much narrower than claimed. It lacks cost-benefit analysis, decision tree modeling, discrete event simulation, partitioned survival modeling, and any substantive ISPOR good-practice/report-generation capability. The Markov functionality is also skeletal, with cumulative costs and QALYs left as placeholders. Therefore the declared description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add your-username/pharmacoeconomic-evaluation without pinning a specific package version. This can cause consumers to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously or unexpectedly changed. In a skill-installation context, that is a real security concern because the command is explicitly presented as the installation path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The overview states the skill follows the Chinese Pharmacoeconomic Evaluation Guidelines, which is a locale-specific constraint, but the overall document is otherwise presented as a general-purpose pharmacoeconomic evaluation skill. Because the skill does not explicitly offer users a locale/framework choice or narrowly scope itself to China-only use in the main description, this can impose a specific regional policy context without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment specifies a 'China threshold' for willingness-to-pay, which embeds a locale-specific policy assumption directly into the example invocation. Because the file does not present this as an explicit user choice or clearly justify that the tool is only for China-specific use, it risks imposing a locale-specific standard by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The text says the skill 'Follows China Pharmacoeconomic Evaluation Guidelines (2023)', which imposes a specific national guideline context. Because the README presents the skill as a general-purpose pharmacoeconomic evaluation tool, this locale-specific framing could steer users into a specific regional standard without explicit opt-in or a clear statement that the skill is intended only for China-context analyses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of many different versions over time and makes builds non-reproducible. This increases supply-chain risk because vulnerable or breaking releases could be resolved implicitly depending on when and where the skill is installed.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Pharmacoeconomic Evaluation Skill
# Python dependencies

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
tqdm>=4.62.0  # Optional, for progress bars in Monte Carlo simulations

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Because numpy is not pinned, it is impossible to determine from this manifest whether deployment will use a version affected by known advisories. While the file does not prove an exploitable vulnerable version is installed, the lack of version control creates uncertainty and avoidable supply-chain exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using an unpinned pandas dependency allows arbitrary newer releases that satisfy the minimum version, reducing reproducibility and making it difficult to verify whether a secure version is installed. In a supply-chain context, this can expose deployments to newly introduced vulnerable versions or unexpected behavior changes.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Python dependencies

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
tqdm>=4.62.0  # Optional, for progress bars in Monte Carlo simulations

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The unpinned pandas dependency means the actual installed release cannot be verified against known advisories from the manifest alone. This is dangerous from a governance and supply-chain perspective because security posture depends on external resolution behavior rather than an audited fixed version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

A minimum-only scipy requirement does not guarantee which actual version will be installed, preventing reliable security verification and reproducible environments. This weakens dependency hygiene and can allow vulnerable or incompatible versions to enter the environment.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
tqdm>=4.62.0  # Optional, for progress bars in Monte Carlo simulations

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Without a pinned scipy version, the manifest cannot demonstrate whether the package version pulled at install time is affected by known issues. This leaves security verification incomplete and can result in inconsistent risk across environments.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: tqdm has 4 known advisory(ies) (CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The optional tqdm package is also unpinned, so the manifest provides no assurance that installers will avoid versions with known advisories. Even though its use here is likely limited to progress bars, any dependency that is resolved unpredictably increases supply-chain uncertainty.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/budget_impact_analysis.py (reported line 266)May include surrounding context.

python

pd.DataFrame: Sensitivity analysis results
        """
        # Save original value
        original_value = getattr(self, parameter)

        results = []

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The budget_impact_report function defaults the currency to yuan, which imposes a specific locale-related setting in user-facing output. The file does not indicate that this skill is intended only for a China-specific context or that users are asked to choose their preferred currency/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example CLI output prints scenario costs suffixed with yuan, which fixes the output to one locale/currency without presenting a user choice. This is a natural-language policy concern because it constrains locale-specific presentation in a generic analysis tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The user-facing report strings repeatedly force the locale-specific unit 'yuan' in printed output. Because this is a general-purpose simulation tool and the file does not document that it is limited to a China-specific context or give the user a choice of currency/locale, this creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.