Open Access Scout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:54 AM UTC
• Version: 1.0.0

Overview

The skill is not system-invasive, but it substantially overstates what it can do and can present mock publication-access results as real.

Review before installing. This skill does not show evidence of stealing data or persisting on the system, but it should not be relied on for journal legitimacy, publisher-policy, predatory-publisher, licensing, or open-access availability decisions until the mock results are removed, Sci-Hub is removed, and the documented features are actually implemented and verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:28

Finding

Fabricated Open-Access Results Presented as Verified Findings

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:24

Finding

Unvalidated DOI Input Embedded in a Displayed URL

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:80

Finding

Documented Capabilities and Entry Points Are Absent from the Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill metadata and examples present this as a journal-vetting tool, but the static finding indicates the actual behavior diverges into locating open copies of papers, including references to Sci-Hub, while failing to perform the promised policy and predatory-publisher checks. That mismatch is dangerous because users may rely on the skill for compliance, legitimacy, or publication-safety decisions while it silently performs a different task and may steer them toward unauthorized or legally risky sources.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module claims to help find legal open-access versions, yet the advertised source list includes Sci-Hub, a site commonly associated with infringing access to copyrighted papers. This contradiction can mislead users into using an unlawful source under the guise of a compliance-oriented tool, creating legal, policy, and trust risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The 'When to Use' section broadens invocation to generic 'evidence insight tasks,' which can cause an orchestrator or human operator to select this skill outside its narrow journal-scout purpose. In the context of an already mismatched skill, overly broad routing language increases the chance of inappropriate execution, misleading outputs, and accidental exposure to unsafe or noncompliant behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill can find open access journals, check journal policies, and identify predatory publishers. In the code, the implemented behavior is limited to listing hardcoded sources and returning mock results for open access versions of papers based on DOI/title, with no logic for journal policy analysis or predatory-publisher detection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/main.py (reported line 14)May include surrounding context.

python

"""Find open access versions of papers."""
    
    SOURCES = [
        {"name": "Unpaywall", "url": "https://api.unpaywall.org/"},
        {"name": "CORE", "url": "https://core.ac.uk/"},
        {"name": "PubMed Central", "url": "https://www.ncbi.nlm.nih.gov/pmc/"},
        {"name": "arXiv", "url": "https://arxiv.org/"},

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Including Sci-Hub as an open-access source is inconsistent with the stated purpose of locating legal open-access copies. In this context, the skill may normalize or facilitate access to pirated content, exposing users or organizations to legal, compliance, and reputational harm.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.