wos-literature-toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.1.2

Overview

The skill is mostly clear about being a WOS crawler and PDF downloader, but it stores WOS login cookies and includes Sci-Hub downloading without enough user control or warning.

Review carefully before installing. Use this only with WOS access and download rights you are authorized to use, consider whether Sci-Hub is acceptable under your legal and institutional rules, install dependencies in an isolated environment, and avoid saving WOS session cookies unless you know where they are stored and how to remove them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-58
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Code Snippet:

markdown

## 前置条件

- Python 3.7+
- 依赖: `pip install selenium pandas openpyxl flask requests`

Technical Analysis

The installation command resolves mutable package versions from the configured Python package index. The project provides no exact version constraints, lockfile, cryptographic hashes, or project-controlled dependency manifest.

Consequently, users executing the documented command may install dependency releases that differ from those reviewed or tested by the project author. If a listed package, its distribution account, or the configured package index is compromised, malicious installation or runtime code could execute with the privileges of the user running pip or the application.

The repository contains only SKILL.md; therefore, no dependency manifest or implementation was available to establish known-safe versions or verify how these packages would be used.

Attack Path

1. An attacker compromises a listed dependency, its publishing account, or a package source configured in the user's environment.
2. The attacker publishes a malicious or backdoored release that satisfies the unconstrained package name.
3. A user follows the documented command:

   bash

   pip install selenium pandas openpyxl flask requests
   

4. pip resolves and installs the attacker-controlled release because the project specifies neither an exact version nor an expected artifact hash.
5. Malicious code executes during installation or when the dependency is imported by the application.

This path depends on compromise or manipulation of a dependency or package source; the audited file itself does not contain an embedded malicious payload.

Impact Assessment

Successful exploitation could permit arbitrary code execution ...[truncated 516 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency manifest that pins every direct dependency to an exact version.
2. Generate a lockfile that also constrains transitive dependencies.
3. Record cryptographic hashes for all permitted distribution artifacts and install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Use a dedicated virtual environment and avoid installing dependencies with administrator or root privileges.
5. Retrieve packages only from an explicitly configured, trusted package index. Consider an internally controlled package mirror for higher-assurance deployments.
6. Enable automated dependency vulnerability and integrity monitoring, and update pinned versions through a documented review and testing process.
7. Include the lockfile and dependency manifest in the distributed skill so users do not need to resolve unconstrained versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is broad enough to match common academic requests such as paper search and download, which can cause the agent to invoke this skill in many ordinary contexts without first establishing user intent or legal/organizational authorization. In this specific skill, that over-triggering is more dangerous because the skill drives web crawling and multi-source PDF acquisition, including Sci-Hub, increasing the chance of routing benign academic queries into copyright-sensitive or policy-violating workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states that WOS login cookies are automatically persisted, but does not prominently warn users about the security implications of storing active authentication material on disk. Persistent cookies can be reused by other local users, malware, or later processes to access the user's WOS session, which is especially sensitive here because the skill requires institutional or personal account access to subscription resources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.