Security audit

PubMed Search Specialist

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local PubMed query-building helper with some dependency hygiene and search-methodology caveats, but no hidden or malicious behavior found.

Install only in an isolated virtual environment, and consider removing or pinning the requirements before installation. Treat language and date filters in generated searches as user-directed protocol choices, not defaults.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned and Unnecessary Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly recommends english[Language] as a filter, which imposes a specific language constraint in natural-language guidance. The file does not indicate that this is optional, user-selected, or justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The examples explicitly add an English-language filter, which can systematically exclude relevant non-English studies without any user request or methodological justification. In a PubMed search skill, this creates a biased retrieval pattern that can reduce completeness and distort evidence synthesis, especially for systematic or clinical review use cases.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The line-by-line template hard-codes an English-language restriction into the final strategy, which encourages users to carry this limitation into real searches by default. In the context of literature retrieval and systematic searching, this can silently narrow evidence coverage and introduce language bias into downstream decisions.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is unpinned, so builds are not reproducible and future installs may pull a different version than expected. While dataclasses is generally low risk here and is part of the standard library on modern Python versions, leaving it unpinned can still introduce supply-chain uncertainty or compatibility issues if an external package is installed.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses requests

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: requests is declared without a version pin, which means installation may resolve to any available release, including one with known flaws or unexpected behavior changes. This increases supply-chain and reproducibility risk even if the package itself is legitimate.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The manifest includes requests without a version pin, and multiple known advisories exist for some releases of that package. Because the version is unspecified, there is no way to verify whether deployment will use a patched or vulnerable release, creating a real risk of inheriting known security issues such as credential leakage or TLS/verification-related flaws.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.