Google Scholar Search Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:00 AM UTC
• Version: 0.1.0

Overview

The skill’s search functionality is coherent, but its installation guidance includes high-impact mutable remote code execution and unpinned dependencies that users should review before installing.

Install only after reviewing the setup path. Prefer the built-in venv/pip flow in an isolated, non-root environment, pin or lock dependencies, and avoid the README’s pipe-to-shell uv installer unless you independently verify the installer. Also expect runtime web scraping of Google Scholar and optional JSON file creation when you provide an output path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:58

Finding

Remote Installer Is Downloaded and Executed Without Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Dependencies and Remote Skill Source Are Not Reproducibly Pinned

Content

View full analysis

=2.31.0 # HTML 解析 beautifulsoup4>=4.12.0 # Google Scholar 作者信息库 scholarly>=1.0.0 ``` Relevant installation instructions from `README.md`: ```bash npx skills add https://github.com/JackKuo666/google-scholar-search-skill.git ``` ```bash uv pip install -r requirements.txt ``` ```bash pip install -r requirements.txt ``` The README also documents another invocation of: ```bash pip install -r requirements.txt ``` ### Technical Analysis All Python dependencies use open-ended lower bounds rather than exact versions. The project provides no lock file, package hashes, or recorded dependency tree. Consequently, two installations performed at different times may resolve to different package versions and transitive dependencies. The recommended `npx skills add` command references the Git repository without pinning a reviewed commit hash or immutable release. Content obtained through that command can therefore change after this audit. There is no evidence in the audited files that the current dependencies or repository are malicious. The weakness is that installation trusts future mutable upstream content that was not part of the reviewed artifact. A compromised package publisher, source repository, maintainer account, or dependency release could introduce code that executes during installation or when the Skill imports and uses the affected package. ### Attack Path 1. An attacker compromises an upstream package, transitive dependency, repository, or maintainer account. 2. The attacker publishes a malicious version that still satisfies one of the `>=` constraints, or changes the repository's default branch. 3. A user runs ...[truncated 1051 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The pipe-to-shell pattern is inherently dangerous because it chains network retrieval directly into command execution without inspection or integrity verification. In a skill README, this is especially risky because users may copy-paste setup commands verbatim, enabling straightforward remote code execution if the fetched content is malicious or altered.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

bash

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

md

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill
uv venv
source .venv/bin/activate  # Linux/macOS

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation is primarily in English, but the console and author output examples switch to Chinese labels such as '结果', '标题', and '姓名'. This suggests the skill may force or assume a specific output language without explicit user opt-in, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code prints paper and author results using Chinese-only labels such as '结果', '标题', '作者', and '摘要'. The skill does not offer a language selection option or document that it is intentionally limited to Chinese users, which violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · google_scholar_search.py (reported line 250)May include surrounding context.

python

@staticmethod
    def write_file(data: Any, filepath: str) -> None:
        """Write data to a file in JSON format.

        Args:
            data: Data to write

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The README instructs users to fetch and execute a remote install script directly with curl ... | sh, which grants immediate shell execution to content retrieved over the network. If the upstream host, transport path, or script is compromised, users could execute arbitrary code during installation.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

bash

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file describes file-output behavior via JSON export and later exposes --output options, but it does not include any user-facing warning that the skill may write data to disk. For markdown files, SQP-2 applies when potentially data-affecting behavior is described without warning about effects on user data or system state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The output format section presents console and author output labels entirely in Chinese, while the rest of the skill documentation is in English and does not mention any locale setting or user choice. This suggests a fixed locale/output language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The module-level documentation frames the script as searching Google Scholar, while get_author_info specifically states it uses the scholarly library and imports it dynamically. This is a mild intent/documentation divergence within the code because the implementation path differs from the surrounding direct Google Scholar request/parsing approach.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This file contains natural-language comments exclusively in Chinese, such as the dependency descriptions on L01, L03, L06, and L09. Because the policy requires avoiding forced language choices unless documented or justified, this can be considered a locale/language constraint without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using requests>=2.31.0 leaves dependency resolution open to any later version, which reduces build reproducibility and makes it harder to verify whether deployed environments include vulnerable or breaking releases. In a security-sensitive agent skill, unpinned dependencies increase supply-chain risk because different installations may pull different code over time.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Google Scholar Search 依赖列表

# HTTP 请求
requests>=2.31.0

# HTML 解析
beautifulsoup4>=4.12.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest references requests without pinning an exact version, while known advisories exist for some releases of that package. Because the selected installed version is not fixed, it is impossible to confirm from this file alone whether deployments will avoid affected versions, creating uncertainty that can mask known vulnerable installations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Using beautifulsoup4>=4.12.0 permits uncontrolled upgrades, which can introduce unreviewed code changes or transitive dependency issues into the environment. This is a supply-chain hygiene problem rather than an immediately exploitable flaw, but it can become dangerous if a compromised or incompatible release is resolved at install time.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

requests>=2.31.0

# HTML 解析
beautifulsoup4>=4.12.0

# Google Scholar 作者信息库
scholarly>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Using scholarly>=1.0.0 is particularly risky because it is a higher-level third-party library that may have multiple transitive dependencies and behavior changes across releases. Leaving it unpinned makes builds non-reproducible and increases exposure to supply-chain compromise or newly introduced insecure behavior in future versions.

Content

Scanner excerpt · requirements.txt (reported line 10)May include surrounding context.

text

beautifulsoup4>=4.12.0

# Google Scholar 作者信息库
scholarly>=1.0.0

Static analysis

No suspicious patterns detected.