Security audit

google-scholar-research-scraper-agent-built-api-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but its Google Scholar scraper scope is broadened to public-data collection and contact details without enough limits or privacy guidance.

Review this skill before installing if you only want Google Scholar metadata. It sends searches to BrowserAct using your API key and may return personal contact-style fields; use it only for lawful, appropriate public-data collection and avoid broad enrichment or outreach workflows unless you have a clear basis to process that data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documented output scope includes email, phone, address, and rating fields, which are unrelated to the stated Google Scholar research purpose. This scope expansion creates a risk of overcollection and downstream misuse of personal data, especially if users invoke the skill under the assumption that it only returns scholarly metadata.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The capability to extract contact details and ratings is not justified by the skill's stated function of scraping Google Scholar research results. Unnecessary collection of such fields increases privacy risk and can enable profiling, unsolicited outreach, or repurposing of data beyond the user's apparent intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill description uses broad trigger phrases like exporting public records, enriching datasets, and monitoring public web data, which can cause the agent to select this skill for generic data-collection requests outside its intended Google Scholar scope. Overbroad invocation language increases the chance of unintended scraping workflows, mismatched user expectations, and misuse of a network-enabled tool.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises collection of potentially sensitive personal data fields without any warning, limitation, or privacy guidance. In context, this makes the skill more dangerous because users may unknowingly initiate personal-data collection through a tool presented as a scholarly research scraper.

Static analysis

No suspicious patterns detected.