Security audit

Unified Research Finder

Security checks across malware telemetry and agentic risk

Overview

This academic search skill is mostly coherent, but it asks users to reveal an API key in chat and automatically sends searches to multiple third-party mirror sites without a clear consent step.

Review before installing. Use only non-sensitive research queries unless you are comfortable sending them to PubMed, Google Scholar, and several mirror domains. Do not paste an NCBI API key into chat; use a local environment variable or another secret mechanism instead, and rotate any key that was already shared in conversation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell scripts, accesses the network, and may read environment variables, but it does not declare any permissions. This creates a capability/expectation mismatch: a host may enable the skill without understanding that it can make outbound requests and consume sensitive runtime configuration such as API keys.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The README describes sending user queries to multiple third-party scholarly sites and optionally using a headless browser, but it does not clearly warn users that their search terms and related metadata will be transmitted off-host. In this skill context, users may submit sensitive medical, academic, or proprietary research topics, so lack of disclosure can cause privacy, compliance, and data-handling risks even if the network behavior is expected for the feature.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list includes broad, generic research phrases such as '找文献', '查论文', and '推荐文献', which can cause the skill to activate on ordinary user requests outside the user’s intended tool choice. Over-broad invocation increases the chance of unnecessary external queries to third-party sites and mirror services, creating privacy, compliance, and unexpected-action risks.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The guide explicitly instructs users to paste their NCBI API key and email into the chat, which exposes a live credential in conversation history and to the assistant runtime. Even if the key is low-sensitivity compared with payment credentials, it is still an account-bound secret that can be retained, logged, or reused, enabling unauthorized API usage and possible account abuse or throttling tied to the user.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script automatically sends user-supplied search queries to multiple third-party Scholar mirror sites, including non-official domains, without any just-in-time disclosure or consent gate. User queries can contain sensitive research topics, unpublished project details, or regulated medical interests, and this skill’s fallback design increases exposure by broadcasting the same query across several operators until one responds.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Telling users to reveal an API key directly in chat normalizes unsafe secret-handling behavior and creates a direct path for credential exposure. In this skill's context, the danger is increased because the workflow is specifically designed to pass the secret onward to a script, meaning the credential is not only disclosed in chat but also propagated through additional processing surfaces.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.