SemanticScholar Search Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:00 AM UTC
• Version: 0.1.0

Overview

The skill appears to perform Semantic Scholar searches as advertised, but its recommended installation path runs mutable remote code and unpinned packages, so it should be reviewed before installation.

Before installing, prefer the documented Python venv path over the curl-to-sh uv installer, avoid running setup with elevated privileges, pin the installer/repository/dependencies to reviewed versions where possible, and expect the tool to contact Semantic Scholar and optionally write JSON files to paths you provide.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:58

Finding

Unverified Remote Installer Executed Directly by Shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Installation Uses Mutable npx Package and Unpinned Git Repository

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Python Dependencies Use Open-Ended Version Constraints

Content

View full analysis

=0.4.0 # HTTP 请求 requests>=2.31.0 ``` ### Technical Analysis Both dependencies use lower-bound-only constraints. A future installation may therefore select any newer release, including versions that were not tested or reviewed with this Skill. No lock file, exact transitive dependency resolution, or package hashes are present in the audited project. This does not prove that the current `semanticscholar` or `requests` packages are malicious. It creates a reproducibility and supply-chain weakness because the installed code can change independently of this repository. The direct `requests` dependency also appears redundant in the audited script, which does not import it directly. If it is not independently required by the Skill, retaining it expands the dependency surface beyond the minimum necessary functionality. ### Attack Path 1. An upstream package account or release process is compromised, or an unsafe future release is published. 2. A user runs `pip install -r requirements.txt`. 3. The resolver selects the latest release satisfying the open-ended constraint. 4. Package installation code or imported runtime code executes in the user's environment. 5. A compromised dependency can access data and resources available to the Python process. ### Impact Assessment A malicious dependency release may execute code during installation or when the Skill imports and uses the package. This could expose files, environment variables, API credentials, and network access available to the user running the Skill. The impact is bounded by the privileges of the installation and runtime account, but it may affect all data accessible from that account or virtual environment. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping downloaded content directly into sh removes any opportunity for inspection and creates an immediate arbitrary code execution path. In the context of a developer skill README, this is more dangerous because users are encouraged to run setup commands locally, so compromise of the upstream script would directly impact the host system.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

bash

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill
uv venv
source .venv/bin/activate  # Linux/macOS

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The sample output labels such as 标题, 作者, and 年份 indicate the skill may present results in Chinese, but the README does not tell users this or provide any language/locale opt-in. SQP-3 applies because this is a natural-language locale constraint that appears to be imposed without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example output labels are entirely in Chinese, while the rest of the skill documentation is in English. This creates a natural-language locale constraint in the skill description without any user opt-in or explanation that the skill is intended to operate in Chinese.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · semantic_scholar_search.py (reported line 256)May include surrounding context.

python

@staticmethod
    def write_file(data: Any, filepath: str) -> None:
        """Write data to a file in JSON format.

        Args:
            data: Data to write

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The README instructs users to fetch and execute a remote installer script with curl ... | sh, which delegates trust to external network content at runtime. If the remote server, transport, or hosted script is compromised, users can execute arbitrary shell commands on their machine during installation.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

bash

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/semanticscholar-search-skill

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown documents --output results.json usage, which causes local file creation or overwrite, but it does not include any warning that the command writes to disk. Because SQP-2 applies to markdown files when behaviors affecting user data or system integrity are undocumented, this omission is a valid missing-warning issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This requirements file contains natural-language comments exclusively in Chinese, which imposes a specific language choice without indicating user preference, opt-in, or a documented region-specific reason. The policy requires avoiding forced language or locale constraints unless they are optional or clearly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using a lower-bounded but unpinned dependency such as semanticscholar>=0.4.0 allows future installs to resolve to unexpected versions, which can introduce vulnerable or breaking releases without review. This weakens supply-chain control and makes builds non-reproducible, increasing the chance that a compromised or insecure dependency version is deployed.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Semantic Scholar Search 依赖列表

# 核心 Semantic Scholar 库
semanticscholar>=0.4.0

# HTTP 请求
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using requests>=2.31.0 without an exact pin permits installation of any later version, including releases that may introduce security regressions or incompatible changes. In a supply-chain context, this reduces reproducibility and makes it harder to verify whether deployed environments are using a known-safe version.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

semanticscholar>=0.4.0

# HTTP 请求
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The manifest references requests without pinning an exact version, while the package has multiple known advisories across versions. Because the resolved version is not fixed, it is impossible to verify from this file alone whether installations will avoid affected releases, creating uncertainty around exposure to known dependency vulnerabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI prints core user-facing labels such as paper title, authors, year, citations, and save confirmations in Chinese, while the rest of the tool description and command interface are in English. This imposes a specific language on users without opt-in or documented locale justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.