Security audit

Dataify Google Scholar

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Google Scholar search integration, but it contradicts its stated no-patents scope by documenting and enabling patent and case-law searches.

Review before installing if you expect a strictly academic-paper-only skill. It sends searches and your Dataify API token to Dataify, may consume credits, and currently includes patent and U.S. case-law search paths despite saying not to use it for patents.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read environment variables, invoke a local Python script, and make network requests, but it declares no corresponding permissions. This creates a trust-boundary problem: operators and users are not clearly informed of the skill's effective capabilities, and a future script change could silently expand data access or exfiltration risk under an under-declared manifest.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises itself as only for academic Google Scholar searches and explicitly says not to use it for patents or general web search, yet its documented mappings support patent and U.S. case-law modes. This mismatch can mislead reviewers, policy engines, and users into approving a skill for a narrower purpose than it actually supports, enabling out-of-scope data access or policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest-level guidance says the skill should not be used for patents, but the parameter documentation explicitly includes a patent-search switch. Contradictory instructions inside the same skill increase the chance that an agent will perform prohibited searches despite the stated restriction, undermining policy enforcement and user expectations.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata says it should not be used for patents or general web search, yet the body explicitly documents patent and case-law parameters. This creates scope drift: an agent may perform searches outside the approved use case, undermining policy boundaries and causing unauthorized or unexpected data retrieval.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script exposes as_sdt values for patent and case-law search even though the skill metadata says the skill should not be used for patents or general web search. This creates a policy-boundary violation: downstream agents or users can invoke out-of-scope searches through supported parameters, undermining trust and potentially violating product restrictions or compliance expectations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: Natural-language parsing actively recognizes phrases like 'include patents' and 'case law' and translates them into enabled as_sdt modes. That makes the scope bypass easier than requiring raw parameter knowledge, increasing the chance that an agent or end user will unintentionally or deliberately perform prohibited searches.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger description is broad enough to activate on generic mentions of scholarly search fields, which can cause the skill to run when the user did not clearly request this specific integration. Over-broad activation increases the chance of unintended external requests and can bypass normal tool-selection safeguards.

Static analysis

No suspicious patterns detected.