Security audit

Scholar search

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently searches scholarly sources and exports citation files, with no hidden or purpose-mismatched behavior found.

Before installing, be aware that the skill can install Python dependencies, make outbound requests to Semantic Scholar, arXiv, and doi.org, optionally use your Semantic Scholar API key for rate limits, and write JSON/BibTeX files to paths chosen in the command.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to install dependencies, perform network requests to external services, read environment variables for an API key, and write output files, yet no permissions are explicitly declared. This creates a capability/permission mismatch that can lead to unintended execution with broader access than reviewers or runtime policy expect, increasing the chance of unsafe file writes, secret exposure, or uncontrolled network activity.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31 beautifulsoup4>=4.12
Confidence: 93% confidence
Finding: The dependency is specified with a lower bound only (`requests>=2.31`), which allows future unreviewed versions to be installed and prevents reproducible builds. This increases supply-chain and stability risk, and it is more concerning here because the skill performs network access to external academic services, so dependency behavior directly affects outbound request handling.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31 beautifulsoup4>=4.12
Confidence: 91% confidence
Finding: `beautifulsoup4>=4.12` is also unpinned, so installs are not reproducible and may pull in unexpected upstream changes. While this is usually a hygiene issue rather than an immediate exploit, it still creates avoidable supply-chain exposure.

Static analysis

No suspicious patterns detected.