T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pubmed_search.py:49- Finding
NCBI API Key Exposed Through Chat, Process Arguments, URL Query Strings, and Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Unified Research Finder
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly performs disclosed literature searches, but it mishandles optional API keys and includes anti-bot/CAPTCHA bypass guidance that users should review before installing.
Install only if you are comfortable sending research queries to PubMed, Google Scholar, and listed Scholar mirrors. Do not paste an NCBI API key into chat; prefer a secret manager or tightly scoped environment variable, and rotate any key already shared. Avoid using the Playwright/browser bypass path unless you have confirmed the target sites permit that access.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:130- Finding
Unpinned Playwright and Browser Installation Creates an Optional Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes specific source priority and coverage, but the analysis indicates the actual code path may only pass parameters through to sub-scripts and does not substantiate those guarantees. That mismatch is risky because users may depend on supposed official or preferred sources, while the skill may silently use different or fewer backends than claimed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation describes specific source priority and coverage, but the analysis indicates the actual code path may only pass parameters through to sub-scripts and does not substantiate those guarantees. That mismatch is risky because users may depend on supposed official or preferred sources, while the skill may silently use different or fewer backends than claimed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documentation describes specific source priority and coverage, but the analysis indicates the actual code path may only pass parameters through to sub-scripts and does not substantiate those guarantees. That mismatch is risky because users may depend on supposed official or preferred sources, while the skill may silently use different or fewer backends than claimed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide explicitly instructs users to paste their email and NCBI API key into the chat, which can expose the credential in conversation history, logs, analytics systems, or to later operators of the agent platform. Although an NCBI API key is not as sensitive as a banking credential, it is still an account-bound secret and should not be solicited through chat without strong warnings and secure handling guidance.
- Content
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This fallback text directly advises users to use Playwright headless browsing to bypass CAPTCHA after Scholar mirrors become inaccessible to plain HTTP requests. That is explicit circumvention guidance for technical access controls, making the skill more dangerous because its stated purpose is broad multi-source retrieval from sites known to deploy anti-bot protections.
- Content
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The final fallback narrative tells users that Playwright can be used to bypass CAPTCHA via a headless browser when all Scholar sources are blocked. Because this is presented as recovery guidance in normal control flow, it effectively embeds anti-protection evasion instructions into the skill's user experience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The changelog explicitly documents adding fixed parameters like
hl=zh-CNand related values to bypass a site's anti-bot protections. Even though this is only a changelog entry, it describes implemented behavior that hard-codes locale and tuning values without user consent while also attempting to evade access controls, which raises both compliance and abuse concerns.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This entry again describes using a fixed
hl=zh-CNparameter as part of a workaround to bypass 403 anti-crawling defenses on third-party Scholar mirror sites. In the context of a research-finder skill that automatically falls back across unofficial mirrors, this makes the behavior more concerning because it operationalizes evasion against multiple external services rather than a user-directed compatibility choice.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README encourages activation through broad, natural-language phrases like 'just talk in plain language,' which can cause the skill to trigger on loosely related conversations. In an agent ecosystem, overbroad triggers increase the chance of unintended network access, external querying, or disclosure of user research interests without clear intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The English instructions similarly frame activation as unrestricted plain-language use, which can make the skill fire in contexts where the user did not clearly request external literature lookup. Because this skill performs network-based searches across multiple external sources, accidental invocation can expose sensitive topics or generate unintended outbound requests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares tools that enable shell and network access but does not define an explicit permission boundary such as allowed-tools or scoped permissions. In an agent environment, that increases the blast radius of prompt injection or misuse because the skill can initiate external requests and subprocesses without a clearly constrained contract.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says the skill activates when users want to find literature, search papers, use PubMed, use Scholar mirrors, or get impact factor or citation data, which spans many loosely related intents. Because it does not clearly distinguish required trigger conditions or non-trigger cases, it may cause the skill to activate for routine discussion of research topics rather than explicit search requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest trigger list contains generic phrases such as “找文献”, “检索论文”, “搜索文献”, “查论文”, “医学文献”, and “学术搜索”, which are broad enough to match common user requests outside a narrowly scoped invocation context. The file does not provide exclusion conditions, negative examples, or a constrained activation context to prevent unintended activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions repeatedly require the assistant to produce results in Chinese, including “整理为中文报告” and Chinese summaries, without indicating that the user may choose another language. This imposes a locale/language preference as a default behavior rather than offering user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Scholar and unified-search workflow sections continue to require “整理为中文报告,” reinforcing a mandatory Chinese output policy across the skill. No opt-in or alternative locale behavior is described, so the language constraint appears unconditional.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
三、第二步：生成一个 API Key（一次性操作）
- 登录后打开：https://www.ncbi.nlm.nih.gov/account/settings/
- 找到 API Key 这一栏，点 Create an API Key（创建密钥）。
- 系统会给你一串类似这样的字符（举例）：
text 0123456789abcdef0123456789abcdef0123
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
三、第二步:生成一个 API Key(一次性操作)
- 登录后打开:https://www.ncbi.nlm.nih.gov/account/settings/
- 找到 API Key 这一栏,点 Create an API Key(创建密钥)。
- 系统会给你一串类似这样的字符(举例):
text 0123456789abcdef0123456789abcdef0123
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document states that
hldefaults tozh-CN, which is a locale/language constraint expressed in natural language documentation. Under the policy, forcing a specific language without user opt-in is a reportable language/locale policy violation unless the constraint is explicitly justified as region-specific, which is not done here.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code returns end-user error text in Chinese, and additional CLI/help-facing strings elsewhere are also Chinese-only. For a general PubMed search helper, forcing a specific language without user opt-in matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The --email and --api-key help strings are presented only in Chinese, which imposes a language choice on users of this general-purpose script. There is no indication in the file that the tool is region- or language-specific, nor any mechanism to choose locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The rate-limit guidance shown to users is only in Chinese, and the bulk hint later in the file is likewise Chinese-only. Because this is natural-language output in a general utility, it violates the policy against forcing a specific language without opt-in.
- Content
Static analysis
No suspicious patterns detected.