ClawHub
Back to skill

Security audit

Semantic Scholar

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its academic-search purpose, but it handles the Semantic Scholar API key and temporary files too broadly for automatic use without review.

Review before installing. Use it only if you are comfortable sending paper queries to Semantic Scholar, avoid sensitive unpublished research queries, and prefer running it in a sandbox. The publisher should restrict authenticated requests to the official Semantic Scholar host, avoid wildcard exposure of raw request helpers, and replace predictable /tmp files with securely generated temporary paths before this is suitable for low-friction automatic invocation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
s2.py:6
Finding

API Key May Be Transmitted to an Arbitrary Network Destination

Content
View full analysis
= 400: r.raise_for_status() return r.json() def s2_get(url, params=None): return _request("GET", url, params=params) def s2_post(url, params=None, json_data=None): return _request("POST", url, params=params, json_data=json_data) ``` ### Technical Analysis The module reads `S2_API_KEY` fr ...[truncated 1757 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
s2.py:292
Finding

Predictable Shared Temporary Files Permit Symlink and Replacement Attacks

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (17)

Tainted flow: 'HEADERS' from os.environ.get (line 6, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · s2.py (reported line 24)May include surrounding context.

python
_last_request_time = time.time()
        try:
            if method == "GET":
                r = requests.get(url, params=params, headers=HEADERS, timeout=30)
            else:
                r = requests.post(url, params=params, json=json_data, headers=HEADERS, timeout=30)
        except (requests.ConnectionError, requests.Timeout) as e:

Tainted flow: 'HEADERS' from os.environ.get (line 6, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · s2.py (reported line 26)May include surrounding context.

python
if method == "GET":
                r = requests.get(url, params=params, headers=HEADERS, timeout=30)
            else:
                r = requests.post(url, params=params, json=json_data, headers=HEADERS, timeout=30)
        except (requests.ConnectionError, requests.Timeout) as e:
            if attempt < max_retries:
                wait = min(2 ** (attempt + 1), 60)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README states the skill triggers automatically whenever the user mentions papers, citations, academic search, or literature discovery, which is a broad activation rule. In agent ecosystems, overly permissive triggers can cause unintended invocation and unnecessary external API calls, potentially leaking user queries or context to the Semantic Scholar service when the user did not explicitly intend to use this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

该文件整体以中文编写并面向用户，但没有说明这是可选语言版本或提示用户可选择其他语言；按 SQP-3，若技能在自然语言层面强制特定语言而无用户 opt-in，可能构成语言/locale 政策问题。尽管 L003 提供英文 README 链接，当前文档本身未明确说明语言选择机制。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

README 是 markdown 文件，适用 SQP-1。该行写明“当用户提到论文、引用、学术搜索、文献发现时自动触发”，触发词覆盖面非常广，且没有限定必须显式提及技能名、特定命令或排除条件，容易在普通对话中被意外触发。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to use Python, write a temporary script, read environment variables, and make outbound API requests, yet it declares no explicit tool scope or permissions boundary. This creates a least-privilege gap: a host agent may grant broader capabilities than necessary, making accidental or unsafe execution harder to constrain or audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match many generic research or literature-related requests, which can cause the skill to be invoked in contexts the user did not clearly intend. Over-broad activation increases the chance of unnecessary network calls, file writes, or execution of skill instructions when a simpler or safer response would suffice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Phase 2: Execute Search

Write ONE Python script. Example:

python
import sys, os

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation without defining any trigger constraints or exclusions, which allows the agent to auto-select this skill based on broad semantic matching rather than explicit user intent. In a skill that can perform external network queries and return synthesized research results, this increases the chance of unintended activation, unnecessary data disclosure in queries, and expansion of the attack surface for prompt-routing or tool-misuse issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
import time, os, json, requests, sys

GRAPH = "https://api.semanticscholar.org/graph/v1"
RECS = "https://api.semanticscholar.org/recommendations/v1"
DATASETS = "https://api.semanticscholar.org/datasets/v1"
HEADERS = {"x-api-key": os.environ.get("S2_API_KEY", "")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_CN.md (reported line 3)May include surrounding context.

md
import time, os, json, requests, sys

GRAPH = "https://api.semanticscholar.org/graph/v1"
RECS = "https://api.semanticscholar.org/recommendations/v1"
DATASETS = "https://api.semanticscholar.org/datasets/v1"
HEADERS = {"x-api-key": os.environ.get("S2_API_KEY", "")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · s2.py (reported line 3)May include surrounding context.

python
import time, os, json, requests, sys

GRAPH = "https://api.semanticscholar.org/graph/v1"
RECS = "https://api.semanticscholar.org/recommendations/v1"
DATASETS = "https://api.semanticscholar.org/datasets/v1"
HEADERS = {"x-api-key": os.environ.get("S2_API_KEY", "")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · s2.py (reported line 4)May include surrounding context.

python
import time, os, json, requests, sys

GRAPH = "https://api.semanticscholar.org/graph/v1"
RECS = "https://api.semanticscholar.org/recommendations/v1"
DATASETS = "https://api.semanticscholar.org/datasets/v1"
HEADERS = {"x-api-key": os.environ.get("S2_API_KEY", "")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · s2.py (reported line 5)May include surrounding context.

python
import time, os, json, requests, sys

GRAPH = "https://api.semanticscholar.org/graph/v1"
RECS = "https://api.semanticscholar.org/recommendations/v1"
DATASETS = "https://api.semanticscholar.org/datasets/v1"
HEADERS = {"x-api-key": os.environ.get("S2_API_KEY", "")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · s2.py (reported line 26)May include surrounding context.

python
if method == "GET":
                r = requests.get(url, params=params, headers=HEADERS, timeout=30)
            else:
                r = requests.post(url, params=params, json=json_data, headers=HEADERS, timeout=30)
        except (requests.ConnectionError, requests.Timeout) as e:
            if attempt < max_retries:
                wait = min(2 ** (attempt + 1), 60)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes local file export functions that are outside the stated academic search/recommendation scope. In an agent environment, unnecessary filesystem write capability expands the attack surface and can be abused to persist data locally, stage sensitive outputs, or interfere with other components that read predictable files under /tmp or caller-chosen paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

export_markdown() and export_json() accept a caller-controlled path and write arbitrary content to that location. If an attacker can influence the path, they may overwrite files accessible to the process, plant misleading artifacts, or abuse symlinks/path traversal in the runtime environment; this is more concerning because file writing is not justified by the skill's stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.