pubmed-edirect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent PubMed/NCBI research purpose, but it needs Review because its local shell scripts and install guidance expose users to avoidable command-execution, file-overwrite, and mutable-dependency risks.

Install only if you are comfortable reviewing and running local shell commands. Prefer a sandbox or disposable workspace, pin or verify EDirect downloads where possible, avoid storing API keys in shell dotfiles, and do not run the bundled helper scripts with untrusted queries, filenames, PMID lists, or result limits until their input validation is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publication_trends.sh:64

Finding

Gnuplot Command Injection Through Untrusted Script Arguments

Content

View full analysis

/dev/null 2>&1; then ``` ### Attack Path 1. An attacker influences an argument passed to `publication_trends.sh`, such as the search query or output filename. 2. The script stores that argument without validating control characters or gnuplot syntax. 3. The value is interpolated into the unquoted heredoc used as gnuplot source. 4. The injected value closes the intended string and introduces an additional gnuplot statement. 5. If gnuplot is installed, it parses and executes the injected statement. 6. A system-command statement can execute an operating-system command under the identity running the Skill. ### Impact Assessment Successful exploitation provides arbitrary comma ...[truncated 422 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search_export_csv.sh:7

Finding

Bash Arithmetic-Expression Injection Through MAX_RESULTS

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi if (( MAX_RESULTS < 1 || MAX_RESULTS > 10000 )); then echo "Error: max_results is outside the permitted range" >&2 exit 1 fi ``` Additionally: - Validate the remotely derived `total` value as digits before arithmetic evaluation. - Apply a conservative upper bound to avoid excessive downloads. - Use `10#$MAX_RESULTS` after validation if leading-zero handling matters. - Add automated tests containing arithmetic metacharacters, array syntax, command substitutions, whitespace, negative values, and oversized numbers. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_fetch_abstracts.sh:30

Finding

Path Traversal and Arbitrary File Overwrite Through PMID Input

Content

View full analysis

"$output_file" 2>/dev/null; then # Check if we got actual content (not empty or error) if [ -s "$output_file" ] && ! grep -q "Error" "$output_file" 2>/dev/null; then echo "✓" success=$((success + 1)) else echo "✗ (empty/error)" rm -f "$output_file" ``` ### Technical Analysis Each line of the input file is assumed to be a PMID, but the script does not verify that it contains only digits. The value is concatenated directly into an output path. Quoting `"$output_file"` prevents shell word splitting and command substitution, but it does not prevent filesystem traversal. An input containing `../` components can resolve outside `OUTPUT_DIR`. The redirection may overwrite an existing accessible file, and the error-cleanup branch may delete the resolved file using `rm -f`. The appended `.txt` suffix limits the set of convenient target names but does not prevent traversal or overwrite of files ending in that suffix. ### Attack Path 1. An attacker supplies or modifies the PMID input file. 2. A line contains traversal components instead of a numeric PMID. 3. The script constructs `OUTPUT_DIR/.txt`. 4. The operating system resolves `../` components outside the intended output directory. 5. Shell redirection creates or truncates the resolved target before `efetch` runs. 6. If the response is empty or contains the string `Error`, the cleanup branch may remove that targ ...[truncated 442 chars]

Remediation

View remediation

&2 fail=$((fail + 1)) continue fi ``` - Canonicalize `OUTPUT_DIR`, build the destination beneath it, and verify that the canonical destination retains the output-directory prefix. - Reject path separators, dots, control characters, and unexpectedly long identifiers. - Use a restrictive `umask`, such as `umask 077`, where output may contain sensitive research material. - Write to a safely created temporary file and atomically rename it only after validating the response. - Avoid deleting a destination unless the script created it during the current iteration. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Unverified Mutable Remote Installer and Container Dependencies

Content

View full analysis

Remediation

View remediation

`, rather than `latest`. - Run installation as an unprivileged dedicated user in a sandbox or disposable environment. - Mount container data with the minimum required access, using read-only mounts where writes are unnecessary. - Document version-update and hash-review procedures so dependency changes trigger a new security review. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: EXAMPLES.md:343

Finding

Unescaped Remote Publication Data Written Into HTML

Content

View full analysis

" ]]; then title=$(echo "$line" | sed 's/<[^>]*>//g') echo "

$title

" >> reading_list.html elif [[ "$line" =~ "" ]]; then abstract=$(echo "$line" | sed 's/<[^>]*>//g') echo "

$abstract

---

" >> reading_list.html fi done echo "" >> reading_list.html ``` ### Technical Analysis The example treats publication titles and abstracts received from a remote service as trusted HTML content. Removing substrings that resemble XML tags with `sed` is not equivalent to parsing XML and applying HTML-context encoding. If hostile or unexpectedly encoded markup reaches `title` or `abstract`, it is concatenated directly into an HTML document. When the generated file is opened in a browser, active elements or event-handler attributes may be interpreted as markup rather than text. Line-oriented regular expressions also do not correctly parse multiline or nested XML, making the data transformation unreliable independently of the injection risk. ### Attack Path 1. A remotely retrieved publication record contains crafted markup or content that survives the tag-removal expression. 2. The example extracts the value using a line-oriented `sed` command rather than an XML parser. 3. The value is appended directly into `reading_list.html` without HTML encoding. 4. A user opens the generated file in a web browser. 5. The browser interprets the injected content in HTML context. 6. Active content may execute subject to the browser's restrictions for local files. ### Impact Assessment The immediate scope is the generated local HTML document. Successful active ...[truncated 391 chars]

Remediation

View remediation

`, `"`, and `'`. - Prefer a small Python example using a standard XML parser and `html.escape`. - Generate the document through a templating system with automatic contextual escaping. - Add a restrictive Content Security Policy, such as disabling scripts, as defense in depth. - Test with titles and abstracts containing XML entities, angle brackets, quotes, Unicode control characters, and multiline content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: ADVANCED.md:318

Finding

SQL Injection Through Concatenated PubMed Record Fields

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (27)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · INSTALL.md (reported line 64)May include surrounding context.

Never do this:

bash

# ❌ Dangerous: Piping remote script directly to shell
curl https://example.com/install.sh | bash

# ❌ Dangerous: Executing without review
sh -c "$(curl -fsSL https://example.com/install.sh)"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · INSTALL.md (reported line 64)May include surrounding context.

Never do this:

bash

# ❌ Dangerous: Piping remote script directly to shell
curl https://example.com/install.sh | bash

# ❌ Dangerous: Executing without review
sh -c "$(curl -fsSL https://example.com/install.sh)"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · INSTALL.md (reported line 67)May include surrounding context.

curl https://example.com/install.sh | bash

❌ Dangerous: Executing without review

sh -c "$(curl -fsSL https://example.com/install.sh)"

text

**Reasons:**

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

The guide instructs users to persistently store sensitive values such as NCBI_API_KEY in shell startup files in plaintext. This can expose secrets to other local users, backups, dotfile syncing, shell-history mistakes, or accidental source control publication, especially on shared or managed systems.

Content

Scanner excerpt · INSTALL.md (reported line 109)May include surrounding context.

erify the content before execution, following best security practices.

Method 2: Manual Installation (Alternative)

If the automated script doesn't work, you can manually install:

bash

# Create edirect directory
mkdir -p ~/edirect
cd ~/edirect

# Download and extract the package
curl -O https://ftp.ncbi.nlm.nih.gov/entrez/entrezdirect/edirect.tar.gz
tar -xzf edirect.tar.gz

# Add to PATH
echo 'export PATH="$HOME/edirect:$PATH"' >> ~/.bashrc
source ~/.bashrc

Post-Installation Configuration

1. Configure API Key (For increased rate limits)

For increased rate limits (10 requests/second vs 3 requests/second), obtain an API key:

1. Create an NCBI account at https://www.ncbi.nlm.nih.gov/
2. Go to Account Settings → API Key Management
3. Generate a new API key

Add the API key to your environment:

bash

# For current session
export NCBI_API_KEY=your_api_key_here

# For permanent configuration
echo 'export NCBI_API_KEY="your_api_key_here"' >> ~/.bashrc
echo 'export

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 263)May include surrounding context.

bash

# Remove the edirect directory
rm -rf ~/edirect

# Remove from PATH in your shell configuration files
# Edit ~/.bashrc, ~/.bash_profile, ~/.zshrc, etc.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 263)May include surrounding context.

bash

# Remove the edirect directory
rm -rf ~/edirect

# Remove from PATH in your shell configuration files
# Edit ~/.bashrc, ~/.bash_profile, ~/.zshrc, etc.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example explicitly demonstrates extracting email addresses from author affiliation text, which can expose personally identifiable contact information at scale. In a literature-mining skill, this creates privacy and compliance risk because users may operationalize bulk harvesting of researcher emails without any warning, minimization guidance, or use constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 100)May include surrounding context.

If the automated script doesn't work, you can manually install:

bash

# Create edirect directory
mkdir -p ~/edirect
cd ~/edirect

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 195)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 219)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 220)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 233)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 198)May include surrounding context.

md

sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

# On macOS with Homebrew
brew install perl

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 223)May include surrounding context.

md

sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

# On macOS with Homebrew
brew install perl

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 254)May include surrounding context.

bash

# Set cache directory
export NCBI_CACHE_DIR="$HOME/.ncbi/cache"
mkdir -p "$NCBI_CACHE_DIR"

Uninstallation

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The Docker example uses a floating tag (ncbi/edirect:latest) rather than a pinned version or digest, which can cause non-reproducible installs and exposes users to supply-chain risk if the image changes unexpectedly. In an installation guide, this is a real security concern because users may assume the container image is stable and trusted.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs use of network-capable tools and remote downloads, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and user visibility, making it easier for an agent to use network access implicitly without clear authorization boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a PubMed literature skill, but the body expands its scope to many other NCBI databases and data types. This scope mismatch can mislead reviewers and users about what the skill can access, increasing the chance of overbroad use and insufficient review of non-PubMed data interactions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Set up dedicated user accounts

### 3. Least Privilege
- Do not run as root
- Set appropriate file permissions
- Use dedicated directories for data

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The query pipeline includes efilter -query "english [LANG]", which imposes a language constraint in natural-language content. Because the document does not explain that this is optional or justified for a specific use case, it conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example explicitly constrains results to english [LANG], which imposes a language preference in natural-language guidance without any opt-in or justification. Under SQP-3, forcing a specific language or locale without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes examples that write command output to local files using shell redirection, such as > abstracts.txt, > pmids.txt, and > output.csv, but it does not warn that existing files may be overwritten. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes shell examples that create or append to local files, such as > ml_healthcare.csv, but the surrounding documentation does not warn users that running the commands will modify files in the current working directory. Similar write operations appear throughout the examples, so users may execute them without realizing they will create or overwrite artifacts locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The systematic review example creates a dated output directory and writes multiple XML batch files plus a CSV summary, but the markdown does not explicitly disclose this filesystem impact. Although the code comments describe the steps, they do not function as a user warning about potentially large local output or repeated file creation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

SQP-3 covers natural-language policy violations such as forcing a specific language or locale without user opt-in. Here, the document states the skill requires a Unix-like system, which imposes a platform-specific constraint in natural language without presenting a user choice or clearly framing it as a region/platform-specific compatibility limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.