ClawHub
Back to skill

Security audit

Baidu Scholar Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward academic search wrapper that sends search terms to a documented external API using a required API key, with no hidden persistence or local data access.

Install only if you are comfortable sending academic search queries to api.heybossai.com under your SkillBoss API key. Avoid putting secrets or sensitive internal research topics in queries, and prefer a fixed version that JSON-escapes the query before sending it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
baidu_scholar_search.sh:22
Finding

Unescaped User Input Enables JSON Request-Body Injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill contains executable shell code but does not declare any tool scope or allowed-tools restrictions. This creates an unnecessary trust gap: a runtime may permit shell execution without explicit least-privilege boundaries, making misuse or future expansion of the script harder to constrain and audit.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Example Usage

bash
curl -s -X POST 'https://api.heybossai.com/v1/pilot' \
-H 'Authorization: Bearer $SKILLBOSS_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"type": "search", "inputs": {"query": "人工智能"}, "prefer": "balanced"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The executable script transmits user-supplied input and an authorization token to a third-party endpoint using curl, but there is no disclosure, validation, or minimization around outbound data handling. In this skill context, external transmission is expected, but it still creates a real privacy and supply-chain risk because all queries are sent off-platform to a remote service using privileged credentials.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

-H "Authorization: Bearer $SKILLBOSS_API_KEY"
-H "Content-Type: application/json"
-d "{"type": "search", "inputs": {"query": "$WD"}, "prefer": "balanced"}"
"https://api.heybossai.com/v1/pilot"

Response path: .result.results

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

This code performs an outbound POST request containing user-supplied input to a third-party endpoint. External transmission is expected for a search skill, but it still creates a real data-exposure surface because user queries leave the local environment and are processed by an external provider.

Content

Scanner excerpt · baidu_scholar_search.sh (reported line 23)May include surrounding context.

sh
pageNum="${2:-0}"
enable_abstract="${3:-false}"

curl -s -X POST \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"$WD\"}, \"prefer\": \"balanced\"}" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script silently sends the user's search query and an API credential to an external service without any user-facing disclosure, consent prompt, or data-handling notice. In a literature-search skill this transmission is functionally expected, but the lack of transparency increases privacy and compliance risk, especially if queries may contain sensitive research topics or internal information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"$WD\"}, \"prefer\": \"balanced\"}" \
  "https://api.heybossai.com/v1/pilot"
# Response path: .result.results

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"$WD\"}, \"prefer\": \"balanced\"}" \
  "https://api.heybossai.com/v1/pilot"
# Response path: .result.results

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · baidu_scholar_search.sh (reported line 27)May include surrounding context.

sh
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"$WD\"}, \"prefer\": \"balanced\"}" \
  "https://api.heybossai.com/v1/pilot"
# Response path: .result.results

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code requires and reads SKILLBOSS_API_KEY from the environment before performing the search. While network access is expected for a literature search tool, credential access is an additional capability not stated in the manifest description itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.