T09 · Insecure Skill Coding Practices
Warning
- Location
knowledge/domain.md:14- Finding
Plaintext HTTP Used for arXiv API Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
botlearn-academic-search
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent academic paper search helper; its main risks are expected external scholarly searches, broad activation wording, and one insecure arXiv HTTP endpoint.
Before installing, understand that academic queries may be sent to arXiv, Semantic Scholar, and Google Scholar-related services. Prefer updating the arXiv endpoint to HTTPS if possible, and be aware that broad triggers like research or cite may activate the skill for general research requests.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Shadow Command Trigger: 'find papers' conflicts with built-in command 'find'
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Fix**: Only return papers actually retrieved from database API responses. If the search returns fewer than 5 relevant results, report that honestly rather than padding with fabricated entries. Include the database query used so the user can verify. ### 15. Ignoring Open Access Status - **Problem**: Returning papers behind paywalls without checking for open-access alternatives. Users without institutional access cannot read the papers. - **Fix**: For each paper, check: (a) arXiv preprint version, (b) Semantic Scholar `openAccessPdf` field, (c) author's personal website or institutional repository. Flag papers with no open-access version available and suggest the user check their institutional library access. ## Workflow Anti-Patterns
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### API Endpoints #### Paper Search - **URL**: `GET https://api.semanticscholar.org/graph/v1/paper/search` - **Rate Limit**: 100 requests/5 minutes (unauthenticated); 1 request/second with API key | Parameter | Description | Example |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad generic terms such as "research," "cite," and "scholar" that are likely to appear in many unrelated conversations. This can cause the skill to activate unexpectedly, pulling the agent into academic-search behavior when the user did not intend it, which may lead to irrelevant actions, context hijacking, or interference with higher-priority skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation clause, "WHEN the user requests academic paper search, literature review, or research discovery," is broad and semantically overlaps with many normal requests for general research or information gathering. In a multi-skill environment, this ambiguity increases the chance of unintended activation and misrouting, especially because the skill is also configured with generic triggers.
- Content