全球12亿文献知识库（8千万中文期刊可下载）

• Outcome: Review
• Latest audit: Oct 12, 2026 · 8:58 AM UTC
• Version: 3.10.3

Overview

This literature-search skill is coherent overall, but it ships a populated gateway bearer secret and can register users, consume quotas, download files, and route users into paid Alipay flows, so it needs Review before installation.

Install only if you are comfortable sharing an email address and search/download requests with SmartLib and related OA services, and with quota-based usage plus optional Alipay purchase flows. The publisher should rotate/remove the bundled gateway secret before distribution and narrow triggers or add stronger confirmations before registration, downloads, subprocess/browser fallback, and payment actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:2

Finding

Hardcoded SmartLib Gateway Bearer Secret

Content

View full analysis

Vulnerability Details

File Location: config.json, lines 2–3
Vulnerability Type: Hardcoded authentication credential
Risk Level: High

Vulnerable Code

json

{
  "SMARTLIB_GATEWAY_URL": "https://1318491188-jvmi3wist0.ap-shanghai.tencentscf.com",
  "SMARTLIB_GATEWAY_SECRET": "sk-O9vHwWzMg0Jf7khvhKQ0xxpdGIOROcw5RyQnROrNuZj9x6hOeHmi2",
  "SMARTLIB_EMAIL": null
}

Technical Analysis

The project distributes a plaintext bearer credential in config.json. SKILL.md instructs the Agent to read this value and place it in the Authorization: Bearer header when calling protected SmartLib Gateway operations, including /quota, /consume, and /search.

Because the credential is included in the Skill package, anyone who can download, inspect, copy, or redistribute the project can recover it without authentication. Bearer credentials grant access based on possession, so disclosure enables an external party to authenticate as the Skill until the credential is revoked or rotated.

This is a concrete credential-exposure vulnerability rather than evidence of credential theft or malicious intent by the project.

Attack Path

1. An attacker obtains a copy of the distributed Skill package.
2. The attacker opens config.json and extracts SMARTLIB_GATEWAY_URL and SMARTLIB_GATEWAY_SECRET.
3. The attacker constructs requests to the configured Gateway using the exposed value in an Authorization: Bearer header.
4. The attacker invokes protected operations available to that shared credential, such as obtaining consumption tokens and submitting gateway search requests.
5. The unauthorized access remains possible until the shared secret is revoked, rotated, or otherwise rejected by the service.

Impact Assessment

The exposed credential crosses the trust boundary between the SmartLib service operator and all recipients of the Skill package. An unauthorized party may impersonate the Skill when ac ...[truncated 400 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed Gateway secret immediately.
2. Remove the populated config.json from the distributed package and version-control history.
3. Distribute only config.example.json containing nonfunctional placeholders.
4. Load the credential at runtime from a protected environment variable, operating-system credential store, or managed secrets service.
5. Replace the shared package-wide bearer secret with per-user or per-installation credentials that are narrowly scoped, independently revocable, and short-lived where possible.
6. Restrict Gateway authorization to only the endpoints and actions required by this Skill.
7. Add automated secret scanning to release and CI workflows to prevent populated credentials from being packaged again.
8. Review Gateway access logs for unauthorized use of the disclosed credential and invalidate outstanding sessions or derived tokens where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Recommending Chromium CDP to overcome anti-hotlinking defenses is a strong red flag because it moves the skill from legitimate retrieval into active circumvention of publisher access controls. That materially increases legal, policy, and security risk by encouraging browser automation against protected resources, potentially enabling session abuse, fingerprint evasion, and retrieval beyond the intended API scope.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

md

| **单次查询条数**| PageSize 20-1000，建议 ≤100 以保证速度|
| **翻页上限**| 无硬限制，但建议不超过 50 页（共 1000 条）/ No hard limit, but ≤50 pages recommended |
| **请求频率**| 有频率限制（未公开数值），触发 429 时自动等待重试|
| **Token 有效期**| Access Token 30 秒，Refresh Token 2 小时（以下游 API 返回为准）。系统自动管理刷新|
| **下载链接有效期**| 约 10 分钟（以下游返回为准），过期需重新调用下载接口|
| **依赖**| 完全依赖 SmartLib API 和网络连接，离线不可用|

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1037)May include surrounding context.

md

| **单次查询条数**| PageSize 20-1000，建议 ≤100 以保证速度|
| **翻页上限**| 无硬限制，但建议不超过 50 页（共 1000 条）/ No hard limit, but ≤50 pages recommended |
| **请求频率**| 有频率限制（未公开数值），触发 429 时自动等待重试|
| **Token 有效期**| Access Token 30 秒，Refresh Token 2 小时（以下游 API 返回为准）。系统自动管理刷新|
| **下载链接有效期**| 约 10 分钟（以下游返回为准），过期需重新调用下载接口|
| **依赖**| 完全依赖 SmartLib API 和网络连接，离线不可用|

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1069)May include surrounding context.

md

| **单次查询条数**| PageSize 20-1000，建议 ≤100 以保证速度|
| **翻页上限**| 无硬限制，但建议不超过 50 页（共 1000 条）/ No hard limit, but ≤50 pages recommended |
| **请求频率**| 有频率限制（未公开数值），触发 429 时自动等待重试|
| **Token 有效期**| Access Token 30 秒，Refresh Token 2 小时（以下游 API 返回为准）。系统自动管理刷新|
| **下载链接有效期**| 约 10 分钟（以下游返回为准），过期需重新调用下载接口|
| **依赖**| 完全依赖 SmartLib API 和网络连接，离线不可用|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document describes Gateway-managed OAuth credentials and submission of an email parameter to Unpaywall but provides no privacy, retention, or credential-handling notice. In an agent-integrated skill, hidden transmission of identifiers and backend credential use can expose users or operators to privacy and secret-management risks, especially when requests are proxied through third-party services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The pipeline explicitly introduces subprocess-based curl execution to fetch remote content, which expands the skill's execution surface from API-mediated retrieval into shell-level process spawning. Even if the example uses an argument list rather than shell interpolation, invoking external binaries on attacker-influenced URLs increases risk around unsafe process use, uncontrolled network access, and operational behavior that is not disclosed in the skill's declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage guidance directs agents to perform bulk downloads and references curl fallback behavior without clearly warning that files will be written to local output paths and that subprocesses may be spawned. In agent settings, undisclosed file writes and process execution are dangerous because users may believe they are requesting only search results while the skill performs materially more invasive actions on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises fully automatic account registration, quota consumption, and payment recovery flows, but does not clearly warn users that their queries and identifiers may be sent to third-party services or that an account may be created on their behalf. This creates a consent and privacy risk, and could also lead to unexpected commercial actions triggered from normal conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that the skill will automatically detect credentials and register through a gateway if none are configured, but it does not explain what credentials are inspected, what user data is sent, or what safeguards apply. In a conversational agent context, silent credential handling and auto-provisioning are dangerous because users may not realize external accounts and data processing are occurring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file is overwhelmingly written to operate in Chinese, and the primary display names are Chinese-first, while no explicit user language choice or opt-in is provided for interaction behavior. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation unless clearly justified and documented as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are overly broad and include common writing-assistance intents like '写文献综述' and 'find supporting citations', which can cause the skill to activate in contexts where the user did not intend external API use, account registration, or quota consumption. In this skill, accidental activation is more dangerous because use requires collecting an email address and may initiate registration, billing, or data transmission to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description does not clearly disclose up front that the user's email is transmitted to external registration, quota, search, download, and payment endpoints. In this skill, that omission is significant because email is mandatory, persisted in config, and reused across multiple third-party operations, so users may not meaningfully consent to the scope of data sharing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The high-level summary uses broad verbs like '查 / 找 / 下载' for academic materials without enough guardrails, increasing the chance of unintended invocation from ordinary conversation. Because this skill performs external account operations and can lead to payment flows, ambiguous triggering raises real privacy and consent risks beyond mere UX confusion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase instructing users to say '我要升级' as a generic upgrade entry is broad enough to be triggered in ordinary conversation about plans, pricing, or hypothetical discussion rather than an explicit purchase intent. In a skill that shares a unified wallet across multiple literature tools, accidental activation could steer users into billing or package-purchase flows they did not intend to enter.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README presents the skill entirely in Chinese and all example trigger phrases and user interactions are Chinese-only, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The version-history entry states '无需验证码' for v3.0, which directly conflicts with the current pre-flight registration flow that requires /register/send-code and /register/verify with a 6-digit code before use. This is an active documentation contradiction that could mislead an agent about whether verification is required.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The upgrade entry description lacks activation boundaries, so the assistant may not distinguish between asking about upgrades and actually initiating a purchase flow. That ambiguity increases the risk of deceptive UX, unintended upsell prompts, or accidental invocation during normal academic-assistant interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.