academic-talon（学术利爪）

• Outcome: Pass
• Latest audit: May 27, 2026 · 10:51 PM UTC
• Version: 1.1.2

Overview

This skill is a disclosed academic research helper, but it should be used with trusted GROBID, Zotero, and private-network PDF-server settings.

Install only if you are comfortable with the skill downloading PDFs, sending PDFs to your configured GROBID service, writing to your Zotero library, and storing PDFs/XML cache locally. Use a local or trusted private GROBID endpoint, use a limited Zotero API key, pin dependencies in your own environment, and keep the PDF server bound to localhost or a trusted private network rather than the public internet.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tainted flow: 'grobid_url' from os.getenv (line 247, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

'consolidateCitations': '1'
            }
            # Set timeout to 5 minutes
            response = requests.post(grobid_url, files=files, data=data, timeout=300)
        
        print(f"Grobid response status code: {response.status_code}")

• Confidence: 88% confidence
• Finding: The code posts local PDF contents to a URL derived from GROBID_API_URL without constraining that destination. If the environment variable is modified to point to an attacker-controlled host, sensitive local documents can be exfiltrated over the network, which is especially risky because this function accepts local file paths and automatically uploads file contents.

Tainted flow: 'params' from os.getenv (line 272, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

}
    
    try:
        res = requests.get(url, params=params, timeout=30)
        res.raise_for_status()
        data = res.json()

• Confidence: 90% confidence
• Finding: The code places the SerpAPI key directly into the request query parameters, which can expose the credential in logs, proxies, browser/debug tooling, and upstream monitoring systems. While this is standard for some APIs, it increases secret exposure compared with header-based authentication and can lead to unauthorized API use if logs are accessed.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: Overly broad trigger guidance can cause the agent to invoke this skill for generic research requests where users did not intend network searches, PDF downloads, external service calls, or Zotero archiving. This expands the chance of unnecessary data sharing and execution of higher-risk actions in benign conversations. In a skill with download, parsing, and serving capabilities, over-invocation materially increases exposure.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list contains generic phrases such as 'literature review', 'find papers', and 'research papers' that are likely to appear in ordinary user requests. This can cause the skill to activate unintentionally, expanding its access to research, PDF, and Zotero-related actions when the user may not have intended to invoke this specific skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Local PDF files are transmitted to the configured GROBID service with no explicit trust boundary enforcement or user-facing consent. In an academic research assistant, PDFs often contain unpublished papers, licensed content, or sensitive annotations, so silent upload to a remote endpoint can cause confidentiality breaches.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Required dependencies
requests
python-dotenv
pyzotero

• Confidence: 97% confidence
• Finding: The dependency is unpinned, so builds may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a skill that performs network operations and processes external research content, this weakens supply-chain control and makes security posture unpredictable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Required dependencies
requests
python-dotenv
pyzotero

• Confidence: 95% confidence
• Finding: An unpinned python-dotenv version allows non-reproducible installs and may pull in future vulnerable releases without review. While this package is typically lower risk than HTTP client libraries, it still affects configuration and secret-loading behavior, so version drift can create security and reliability issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Required dependencies
requests
python-dotenv
pyzotero

• Confidence: 94% confidence
• Finding: Leaving pyzotero unpinned creates supply-chain and reproducibility risk because future installs may fetch unreviewed versions with behavioral or security changes. Since this skill archives data to Zotero and likely handles remote metadata and credentials, dependency drift can affect integrity and access patterns.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The file includes requests without a version constraint, and the scanner reports multiple known advisories affecting some requests releases. Because this skill fetches external resources and may use credentials or sessions while interacting with academic sources and local PDF serving workflows, a vulnerable requests version could expose credentials, weaken TLS/session guarantees, or leak sensitive data depending on the installed release.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: The scanner flags python-dotenv for a file-overwrite issue in certain versions, and because the dependency is unpinned this project could resolve to an affected release. The practical risk depends on whether the skill actually invokes vulnerable write-path functionality such as set_key on attacker-influenced paths, but the dependency state still leaves room for exploitation in some deployments.

Static analysis

No suspicious patterns detected.