Security audit

Academic Research Conflict

Security checks for vulnerabilities and agentic risk

Overview

This academic-search skill mostly does what it claims, but it under-discloses some outbound services and writes hard-coded promotional attribution into generated reports.

Review before installing if you plan to use generated reviews as academic or professional deliverables. The skill contacts OpenAlex and, for deep reads, Unpaywall; it sends a hard-coded contact email in API requests, caches data under /tmp/litreview_cache, can write reports to a path you provide, and inserts Topanga attribution into Markdown output by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: academic_client.py:199
Finding: Unconditional Third-Party Promotional Content Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: academic_client.py:29
Finding: Predictable Shared Temporary Cache Permits Local Cache Poisoning and Unsafe File Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The finding indicates both undocumented external service usage and unsupported claims about literature review automation and full-text fetching. Undisclosed network dependencies and overstated functionality are dangerous because they can introduce unreviewed data flows, privacy concerns, and trust boundary violations that reviewers and users do not anticipate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The finding indicates both undocumented external service usage and unsupported claims about literature review automation and full-text fetching. Undisclosed network dependencies and overstated functionality are dangerous because they can introduce unreviewed data flows, privacy concerns, and trust boundary violations that reviewers and users do not anticipate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The finding indicates both undocumented external service usage and unsupported claims about literature review automation and full-text fetching. Undisclosed network dependencies and overstated functionality are dangerous because they can introduce unreviewed data flows, privacy concerns, and trust boundary violations that reviewers and users do not anticipate.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and invokes capabilities that imply network access plus file read/write behavior, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent may grant or assume broader access than intended, making it harder to enforce least privilege and increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger language is broad enough to activate on many generic research or reference-gathering requests, which can cause the skill to run in situations where it is not the best-scoped tool. In an agent environment, overbroad activation increases the chance of unnecessary network calls, unintended file writes, and accidental disclosure of user queries to external services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/scholar-search.py (reported line 164)May include surrounding context.
python
# Try Unpaywall for better PDF URL try: r = requests.get(f"https://api.unpaywall.org/v2/{paper['doi']}?email={MAILTO}", timeout=10) if r.status_code == 200: up = r.json() best = up.get("best_oa_location") or {}

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description and usage sections are written entirely in Chinese, and the README does not indicate that the tool is region-specific or provide an opt-in language choice. This can violate language/locale policy when users are not given a choice of language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The top-level docstring includes Chinese-language descriptive text for the client without indicating that the user can choose a preferred language or locale. This is a natural-language locale choice embedded in the file and may conflict with organizational language policy if the environment expects user-selectable language behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends a fixed personal contact identifier via the mailto query parameter on every OpenAlex request without any user-facing disclosure or consent. While this is not code execution or data exfiltration of user input, it is still a privacy/transparency issue because users invoking the skill may unknowingly cause disclosure of the author's email address to a third-party service and create attribution/audit trails tied to that identifier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The tool can write review output to an arbitrary filesystem path supplied by --output, but this side effect is only minimally described and not prominently disclosed at the module/skill level. In an agent setting, undeclared file writes can be surprising and may overwrite user files or place data in sensitive locations if the path is influenced by higher-level prompting or automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest and module docstring describe the skill as performing academic search via the OpenAlex API, but the deep_read function makes an additional network request to api.unpaywall.org to enrich results with PDF URLs. While related to academic paper retrieval, this is still behavior beyond the stated single-API scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.