Google Scholar Search Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:00 AM UTC
• Version: 0.1.0

Overview

The skill’s search functionality is coherent, but its installation guidance includes high-impact mutable remote code execution and unpinned dependencies that users should review before installing.

Install only after reviewing the setup path. Prefer the built-in venv/pip flow in an isolated, non-root environment, pin or lock dependencies, and avoid the README’s pipe-to-shell uv installer unless you independently verify the installer. Also expect runtime web scraping of Google Scholar and optional JSON file creation when you provide an output path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:58
• Finding: Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 58 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions pipe a mutable remote script directly into a shell. The downloaded content is executed immediately without: - Pinning the installer to a reviewed version. - Verifying a cryptographic checksum or signature. - Saving and inspecting the script before execution. - Constraining the script in a sandbox or low-privilege environment. The HTTPS source is associated with the uv project, but source reputation does not eliminate the underlying risk. If the remote host, publishing account, DNS resolution, TLS trust path, or delivery infrastructure is compromised, the command will execute attacker-controlled shell code. This behavior exceeds the minimum privileges necessary for the Skill. The project can be installed with Python's built-in `venv` and `pip`, both of which are already documented as alternatives. ### Attack Path 1. An attacker compromises the remote installer host, its publishing process, or another component of the delivery chain. 2. The attacker modifies the response returned by `https://astral.sh/uv/install.sh`. 3. A user follows the README and runs the documented command. 4. `curl` retrieves the modified payload. 5. The pipe sends the payload directly to `sh` without inspection or integrity verification. 6. The payload executes with all privileges available to the invoking user. ### Impact Assessment A malicious installer could execute arbitrary commands with the invoking user's privileges. Depending on that user's access, this could permit: - Reading, modifying, or deleting user-accessible files. - Accessing credentials, API tokens, SSH material, and development configuration. - Modifying shell profiles or application configuration. - Ins ...[truncated 302 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the pipe-to-shell installation method from the README. 2. Prefer the existing built-in virtual-environment workflow: ```bash python -m venv .venv source .venv/bin/activate python -m pip install -r requirements.txt ``` 3. If uv must remain an installation option: - Link to official installation documentation rather than executing a remote script. - Pin a specific uv release. - Download the release artifact as a separate step. - Verify its published cryptographic checksum or signature. - Only execute the verified artifact after users have an opportunity to inspect it. 4. Explicitly advise users not to run installation commands as root or through `sudo`. 5. Prefer distribution package managers or other verifiable, versioned installation channels where available. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Dependencies and Remote Skill Source Are Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Locations**: - `requirements.txt`, lines 1–10 - `README.md`, line 27 - `README.md`, lines 68–87 **Vulnerability Type**: Mutable and insufficiently verified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt`: ```text # Google Scholar Search 依赖列表 # HTTP 请求 requests>=2.31.0 # HTML 解析 beautifulsoup4>=4.12.0 # Google Scholar 作者信息库 scholarly>=1.0.0 ``` Relevant installation instructions from `README.md`: ```bash npx skills add https://github.com/JackKuo666/google-scholar-search-skill.git ``` ```bash uv pip install -r requirements.txt ``` ```bash pip install -r requirements.txt ``` The README also documents another invocation of: ```bash pip install -r requirements.txt ``` ### Technical Analysis All Python dependencies use open-ended lower bounds rather than exact versions. The project provides no lock file, package hashes, or recorded dependency tree. Consequently, two installations performed at different times may resolve to different package versions and transitive dependencies. The recommended `npx skills add` command references the Git repository without pinning a reviewed commit hash or immutable release. Content obtained through that command can therefore change after this audit. There is no evidence in the audited files that the current dependencies or repository are malicious. The weakness is that installation trusts future mutable upstream content that was not part of the reviewed artifact. A compromised package publisher, source repository, maintainer account, or dependency release could introduce code that executes during installation or when the Skill imports and uses the affected package. ### Attack Path 1. An attacker compromises an upstream package, transitive dependency, repository, or maintainer account. 2. The attacker publishes a malicious version that still satisfies one of the `>=` constraints, or changes the repository's default branch. 3. A user runs ...[truncated 1051 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace open-ended dependency constraints with reviewed exact versions. 2. Generate and commit a reproducible lock file that includes all transitive dependencies. 3. Require cryptographic hashes for downloaded Python distributions, such as through a hash-locked requirements file and `pip --require-hashes`. 4. Pin the Git-based Skill installation to a reviewed commit hash or immutable, signed release rather than the default branch. 5. Review dependency updates before changing pins and use automated vulnerability and provenance scanning. 6. Prefer packages with verified publisher provenance and documented release artifacts. 7. Install dependencies in a dedicated, non-privileged virtual environment rather than globally or as root. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill

• Confidence: 98% confidence
• Finding: The pipe-to-shell pattern is inherently dangerous because it chains network retrieval directly into command execution without inspection or integrity verification. In a skill README, this is especially risky because users may copy-paste setup commands verbatim, enabling straightforward remote code execution if the fetched content is malicious or altered.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill
uv venv
source .venv/bin/activate  # Linux/macOS

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The documentation is primarily in English, but the console and author output examples switch to Chinese labels such as '结果', '标题', and '姓名'. This suggests the skill may force or assume a specific output language without explicit user opt-in, which is a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This code prints paper and author results using Chinese-only labels such as '结果', '标题', '作者', and '摘要'. The skill does not offer a language selection option or document that it is intentionally limited to Chinese users, which violates the language/locale policy criteria.

Session Persistence

Medium

• Category: Rogue Agent

Content

@staticmethod
    def write_file(data: Any, filepath: str) -> None:
        """Write data to a file in JSON format.

        Args:
            data: Data to write

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/google-scholar-search-skill

• Confidence: 97% confidence
• Finding: The README instructs users to fetch and execute a remote install script directly with `curl ... | sh`, which grants immediate shell execution to content retrieved over the network. If the upstream host, transport path, or script is compromised, users could execute arbitrary code during installation.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This markdown file describes file-output behavior via JSON export and later exposes `--output` options, but it does not include any user-facing warning that the skill may write data to disk. For markdown files, SQP-2 applies when potentially data-affecting behavior is described without warning about effects on user data or system state.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The output format section presents console and author output labels entirely in Chinese, while the rest of the skill documentation is in English and does not mention any locale setting or user choice. This suggests a fixed locale/output language without explicit opt-in or justification.

Intent-Code Divergence

Low

• Confidence: 79% confidence
• Finding: The module-level documentation frames the script as searching Google Scholar, while get_author_info specifically states it uses the scholarly library and imports it dynamically. This is a mild intent/documentation divergence within the code because the implementation path differs from the surrounding direct Google Scholar request/parsing approach.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This file contains natural-language comments exclusively in Chinese, such as the dependency descriptions on L01, L03, L06, and L09. Because the policy requires avoiding forced language choices unless documented or justified, this can be considered a locale/language constraint without opt-in.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Google Scholar Search 依赖列表

# HTTP 请求
requests>=2.31.0

# HTML 解析
beautifulsoup4>=4.12.0

• Confidence: 90% confidence
• Finding: Using requests>=2.31.0 leaves dependency resolution open to any later version, which reduces build reproducibility and makes it harder to verify whether deployed environments include vulnerable or breaking releases. In a security-sensitive agent skill, unpinned dependencies increase supply-chain risk because different installations may pull different code over time.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest references requests without pinning an exact version, while known advisories exist for some releases of that package. Because the selected installed version is not fixed, it is impossible to confirm from this file alone whether deployments will avoid affected versions, creating uncertainty that can mask known vulnerable installations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

# HTML 解析
beautifulsoup4>=4.12.0

# Google Scholar 作者信息库
scholarly>=1.0.0

• Confidence: 89% confidence
• Finding: Using beautifulsoup4>=4.12.0 permits uncontrolled upgrades, which can introduce unreviewed code changes or transitive dependency issues into the environment. This is a supply-chain hygiene problem rather than an immediately exploitable flaw, but it can become dangerous if a compromised or incompatible release is resolved at install time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

beautifulsoup4>=4.12.0

# Google Scholar 作者信息库
scholarly>=1.0.0

• Confidence: 93% confidence
• Finding: Using scholarly>=1.0.0 is particularly risky because it is a higher-level third-party library that may have multiple transitive dependencies and behavior changes across releases. Leaving it unpinned makes builds non-reproducible and increases exposure to supply-chain compromise or newly introduced insecure behavior in future versions.

Static analysis

No suspicious patterns detected.