SemanticScholar Search Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:00 AM UTC
• Version: 0.1.0

Overview

The skill appears to perform Semantic Scholar searches as advertised, but its recommended installation path runs mutable remote code and unpinned packages, so it should be reviewed before installation.

Before installing, prefer the documented Python venv path over the curl-to-sh uv installer, avoid running setup with elevated privileges, pin the installer/repository/dependencies to reviewed versions where possible, and expect the tool to contact Semantic Scholar and optionally write JSON files to paths you provide.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:58
• Finding: Unverified Remote Installer Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md:58-60` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```bash # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions pipe a remotely retrieved, mutable shell script directly into `sh`. The downloaded content is executed immediately without version pinning, signature or checksum verification, local inspection, or an integrity trust policy. Although the URL appears to be the official uv installer, the effective payload can change after this project has been reviewed. Compromise of the hosting infrastructure, domain, release process, or TLS trust chain could therefore turn this documented command into arbitrary code execution. This behavior exceeds the minimum privileges necessary for the Skill. The Skill only requires Python dependencies, and the README already provides a built-in `venv` installation method that does not require downloading and immediately executing an additional installer. ### Attack Path 1. An attacker compromises or gains control over the remote installer, its hosting infrastructure, or the delivery path. 2. The attacker modifies the response served from `https://astral.sh/uv/install.sh`. 3. A user follows the README and runs the documented command. 4. `curl` downloads the attacker-controlled response and pipes it directly to `sh`. 5. The payload executes with all privileges available to that user's shell. 6. The payload can read or modify user-accessible files, credentials, repositories, shell configuration, and development environments, and may install persistence where the account has permission. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation command. In a normal user shell, this can expose source code, API keys, SSH credentials, Claude co ...[truncated 290 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the pipe-to-shell installation command. - Prefer the documented built-in Python `venv` workflow, which is sufficient for this Skill. - If uv must be supported, direct users to install a specific reviewed release through a trusted platform package manager. - Alternatively, document separate download, integrity verification, and execution steps. - Pin the installer or release artifact to a specific version. - Publish and verify a cryptographic checksum or signature before execution. - Advise users not to run installation commands with elevated privileges. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:27
• Finding: Installation Uses Mutable npx Package and Unpinned Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `README.md:27-30` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash ### Method 1: One-Click Installation via npx (Recommended) ```bash npx skills add https://github.com/JackKuo666/semanticscholar-search-skill.git ``` ``` ### Technical Analysis The recommended installation command invokes `npx` without specifying a reviewed version of the `skills` package and supplies a Git repository URL without pinning it to a commit SHA or signed release tag. Consequently, the command can resolve and execute package code or install repository content that differs from the version covered by this audit. This creates a supply-chain trust dependency on both the npm package resolution process and the mutable head of the remote Git repository. The audit did not establish that either source is currently malicious. The vulnerability is the lack of reproducibility and integrity controls around executable installation tooling and installed Skill content. ### Attack Path 1. An attacker compromises the relevant npm package, publisher account, package resolution path, or remote Git repository. 2. The attacker publishes a malicious permitted package version or changes the repository's default branch. 3. A user runs the recommended `npx skills add` command. 4. `npx` resolves and runs the mutable installation tool. 5. The tool obtains Skill content from the mutable repository reference. 6. Malicious package code may execute during installation, or altered Skill instructions and scripts may be placed in the user's Claude Skill directory and affect later sessions. ### Impact Assessment Compromise of the executable npm component could permit code execution with the installing user's privileges. Compromise of the installed repository could modify Skill instructions or scripts, potentially affecting future agent behavior and accessing resources available to the Skill runtime. Th ...[truncated 149 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the `skills` npm package to an exact, reviewed version in the `npx` command. - Pin the Git repository to a reviewed commit SHA rather than its mutable default branch. - Prefer a signed release artifact and document signature or checksum verification. - Avoid presenting a mutable remote installation command as the recommended option. - Document the exact package and repository revisions covered by security review. - Run installation tooling without elevated privileges and in an isolated environment where practical. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Python Dependencies Use Open-Ended Version Constraints<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-7` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```text # Semantic Scholar Search 依赖列表 # 核心 Semantic Scholar 库 semanticscholar>=0.4.0 # HTTP 请求 requests>=2.31.0 ``` ### Technical Analysis Both dependencies use lower-bound-only constraints. A future installation may therefore select any newer release, including versions that were not tested or reviewed with this Skill. No lock file, exact transitive dependency resolution, or package hashes are present in the audited project. This does not prove that the current `semanticscholar` or `requests` packages are malicious. It creates a reproducibility and supply-chain weakness because the installed code can change independently of this repository. The direct `requests` dependency also appears redundant in the audited script, which does not import it directly. If it is not independently required by the Skill, retaining it expands the dependency surface beyond the minimum necessary functionality. ### Attack Path 1. An upstream package account or release process is compromised, or an unsafe future release is published. 2. A user runs `pip install -r requirements.txt`. 3. The resolver selects the latest release satisfying the open-ended constraint. 4. Package installation code or imported runtime code executes in the user's environment. 5. A compromised dependency can access data and resources available to the Python process. ### Impact Assessment A malicious dependency release may execute code during installation or when the Skill imports and uses the package. This could expose files, environment variables, API credentials, and network access available to the user running the Skill. The impact is bounded by the privileges of the installation and runtime account, but it may affect all data accessible from that account or virtual environment. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each direct dependency to an exact reviewed version. - Generate and commit a lock file that fixes transitive dependency versions. - Require cryptographic hashes during installation, for example through a hash-locked requirements file and `pip --require-hashes`. - Review and update pinned dependencies through a controlled dependency-update process. - Remove `requests` as a direct dependency if the Skill does not use it directly and it is already managed transitively by the Semantic Scholar client. - Install dependencies inside a dedicated, non-privileged virtual environment. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill

• Confidence: 97% confidence
• Finding: Piping downloaded content directly into `sh` removes any opportunity for inspection and creates an immediate arbitrary code execution path. In the context of a developer skill README, this is more dangerous because users are encouraged to run setup commands locally, so compromise of the upstream script would directly impact the host system.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill
uv venv
source .venv/bin/activate  # Linux/macOS

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The sample output labels such as `标题`, `作者`, and `年份` indicate the skill may present results in Chinese, but the README does not tell users this or provide any language/locale opt-in. SQP-3 applies because this is a natural-language locale constraint that appears to be imposed without user choice or justification.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The example output labels are entirely in Chinese, while the rest of the skill documentation is in English. This creates a natural-language locale constraint in the skill description without any user opt-in or explanation that the skill is intended to operate in Chinese.

Session Persistence

Medium

• Category: Rogue Agent

Content

@staticmethod
    def write_file(data: Any, filepath: str) -> None:
        """Write data to a file in JSON format.

        Args:
            data: Data to write

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill

• Confidence: 95% confidence
• Finding: The README instructs users to fetch and execute a remote installer script with `curl ... | sh`, which delegates trust to external network content at runtime. If the remote server, transport, or hosted script is compromised, users can execute arbitrary shell commands on their machine during installation.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The markdown documents `--output results.json` usage, which causes local file creation or overwrite, but it does not include any warning that the command writes to disk. Because SQP-2 applies to markdown files when behaviors affecting user data or system integrity are undocumented, this omission is a valid missing-warning issue.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This requirements file contains natural-language comments exclusively in Chinese, which imposes a specific language choice without indicating user preference, opt-in, or a documented region-specific reason. The policy requires avoiding forced language or locale constraints unless they are optional or clearly justified.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Semantic Scholar Search 依赖列表

# 核心 Semantic Scholar 库
semanticscholar>=0.4.0

# HTTP 请求
requests>=2.31.0

• Confidence: 90% confidence
• Finding: Using a lower-bounded but unpinned dependency such as semanticscholar>=0.4.0 allows future installs to resolve to unexpected versions, which can introduce vulnerable or breaking releases without review. This weakens supply-chain control and makes builds non-reproducible, increasing the chance that a compromised or insecure dependency version is deployed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

semanticscholar>=0.4.0

# HTTP 请求
requests>=2.31.0

• Confidence: 96% confidence
• Finding: Using requests>=2.31.0 without an exact pin permits installation of any later version, including releases that may introduce security regressions or incompatible changes. In a supply-chain context, this reduces reproducibility and makes it harder to verify whether deployed environments are using a known-safe version.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The manifest references requests without pinning an exact version, while the package has multiple known advisories across versions. Because the resolved version is not fixed, it is impossible to verify from this file alone whether installations will avoid affected releases, creating uncertainty around exposure to known dependency vulnerabilities.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The CLI prints core user-facing labels such as paper title, authors, year, citations, and save confirmations in Chinese, while the rest of the tool description and command interface are in English. This imposes a specific language on users without opt-in or documented locale justification, which matches the language/locale policy violation criteria.

Static analysis

No suspicious patterns detected.