Security audit

Scholar Deep Research

Security checks across malware telemetry and agentic risk

Overview

The skill’s research workflow is mostly coherent, but it automatically checks GitHub and can fast-forward its own code during normal use, which users should review before installing.

Review before installing. Use a package-managed release or set `SCHOLAR_SKIP_UPDATE_CHECK=1` and pin a reviewed commit if you do not want the skill to update itself from GitHub during normal use. Expect outbound requests to scholarly APIs and keep generated state/cache files private if your research topic is sensitive. Optional email/API-key settings are for rate limits; do not provide personal credentials unless you are comfortable sharing them with the named services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README documents an auto-update mechanism that runs on every skill invocation and performs `git fetch`/fast-forward against the upstream repository. For a literature-research skill, modifying local code at runtime is context-inappropriate and introduces a supply-chain risk: a compromised upstream repo, malicious dependency drift, or unexpected behavior change can alter the skill without explicit user review. The skill context makes this more dangerous because users expect research assistance, not self-modifying code execution paths tied to network state.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Automatically invoking `git` network/update operations each time the skill runs expands the capability surface beyond the stated research function. This creates unnecessary exposure to remote content changes, repository compromise, and non-deterministic execution, all of which are especially risky in an agent setting where invocation may be automatic and frequent. In this context, a research skill should not silently acquire code-changing behavior from the network.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: README documents that the skill automatically runs `git fetch` and fast-forwards itself whenever activated for a new research task. That gives a literature-review skill an unnecessary code-update capability, meaning future executions may silently run changed code from a remote repository without an explicit install/approval step; if the upstream repo or transport is compromised, the agent's behavior can change outside the user's reviewed version.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The auto-update feature is context-inappropriate for an academic research skill because it expands the trust boundary from local, reviewed scripts to live remote repository state. Even if intended for convenience, this creates a supply-chain and change-control risk unrelated to the declared research/reporting purpose, and can make outputs non-reproducible across runs.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: Claiming the skill is 'offline-first' is misleading when the workflow instructs the agent to perform a networked update check before research begins. This discrepancy can cause users or orchestrators to run the skill in environments where external network access or code mutation is unexpected, weakening trust-boundary assumptions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: An automatic code-update capability is not necessary for the stated research function and materially increases attack surface. If the upstream repository, remote configuration, or transport path is compromised, the skill could pull and execute altered code under the guise of routine research preparation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation explicitly markets an auto-update capability for a research/reporting skill, which implies code can change outside the user’s original installation intent. In an agent skill context, normalizing self-updating behavior increases supply-chain risk because future executions may fetch and apply unreviewed code without clear user consent.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The page states the skill 'fast-forwards' itself from origin on every invocation, which is a direct claim of automatic remote code update at runtime. That is dangerous because each invocation becomes a potential supply-chain execution point, allowing repository compromise, malicious upstream changes, or accidental breaking changes to propagate immediately into agent behavior.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Listing 'Auto-update on invocation' as a feature reinforces unsafe expectations that dynamic code changes are normal and beneficial for this skill. In a tool that may be run by autonomous agents, this broadens the trust boundary and can lead operators to permit remote code mutation without review.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script performs autonomous self-update of the skill checkout by fetching from origin and fast-forward pulling code into the local installation. That introduces a supply-chain and integrity risk outside the declared scholarly-research function: if the upstream repo, remote configuration, or transport trust is compromised, the skill can silently replace its own code and alter future behavior.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This code includes both repository mutation and local file mutation capabilities, including git pull and writing the .last_update_check file, which are not necessary for producing literature reviews or scholarly synthesis. In the context of a research skill, granting the skill authority to modify its own checkout materially increases blast radius because successful abuse can persist changes across sessions and shift the tool's behavior over time.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger language says the skill should activate proactively when a question 'clearly requires academic grounding,' which is subjective and broad. Overbroad activation can cause the agent to invoke networked, multi-step tooling unexpectedly, increasing the chance of unnecessary data exposure, unintended file creation, or execution of higher-risk workflows in contexts where a simple answer would suffice. Because this skill can fetch remote content and manage persistent state, loose trigger criteria are more dangerous than for a purely local prompt template.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The statement that the skill 'triggers automatically' does not sufficiently constrain when that should happen, despite the workflow involving external queries, local state writes, and potentially update-related actions. Ambiguous auto-invocation criteria can lead to unintended execution and surprise side effects, which is a security and safety concern in agent environments. The context increases risk because the skill is not a passive formatter; it is an active orchestration workflow.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Silent automatic update checks reduce transparency about network activity and codebase inspection occurring before the main task. Hidden preflight behavior is dangerous because users may not realize the skill contacts remotes, reads repository state, and may alter operational assumptions prior to handling their request.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation without any explicit trigger constraints, allowing the agent to activate this powerful research workflow based only on broad semantic matching. Because the skill can initiate multi-phase external querying, data collection, and report generation, overly permissive activation increases the chance of unintended execution, unnecessary outbound requests, and misuse in contexts where the user did not actually request scholarly research.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Advertising automatic self-updating without a prominent warning deprives users of informed consent about remote code fetch-and-apply behavior. In an agent ecosystem, hidden or underexplained update semantics are especially risky because they can silently alter execution logic, dependencies, and prompts between runs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The installation section encourages users to clone a repository and run dependency installation commands, including a prompt suggesting they ask an agent to do it automatically, without clearly warning that this writes files locally and executes package installation on the user's machine. In the context of an agent skill, this increases supply-chain and unintended-action risk because users may delegate execution without reviewing what will be installed or changed.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The page advertises automatic fast-forward self-upgrade to the latest upstream version on every invocation, without requiring user approval or warning that runtime behavior can change over time. For an agent skill, this is particularly dangerous because it creates a persistent remote code trust channel: a later upstream compromise or malicious update could alter behavior and be pulled automatically into user environments.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The code conditionally transmits a user-provided email address to OpenAlex via both the `mailto` query parameter and the `From` header. While this is likely intended for OpenAlex's polite-pool rate limiting and not malicious, it is still an external disclosure of personally identifiable contact information without an in-code consent prompt or minimization at the point of transmission.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.