ClawHub
Back to skill

Security audit

Scholar Research

Security checks for vulnerabilities and agentic risk

Overview

This academic research skill is mostly purpose-aligned, but it should be reviewed because it can fetch arbitrary PDF URLs, write downloaded content locally without size or type limits, and documents an unsafe placeholder Git install command.

Review this skill before installing. It is not clearly malicious, but only use it with non-sensitive research queries, avoid the placeholder Git install command, and run PDF download/extraction in a restricted environment because arbitrary or malicious PDFs could be fetched and written to disk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
src/scholar_research/search.py:15
Finding

Academic Search Queries Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/scholar_research/figure_extract.py:175
Finding

Arbitrary PDF URL Retrieval Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/scholar_research/figure_extract.py:202
Finding

Remote Downloads Have No Size or File-Type Validation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:16
Finding

Documentation Recommends Installation from an Unpinned Placeholder Git Repository

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

and analysis tool that queries multiple databases (arXiv, PubMed, OpenAlex, CrossRef), scores papers by relevance/quality, and generates field timelines.

Features

  • 🔍 Search across 4 academic databases
  • 📊 Score papers (0-100) based on citations, recency, and credibility
  • 📈 Generate field evolution timelines
  • 🧪 Comprehensive test coverage

Installation

bash
# From GitHub
pip install git+https://github.com/yourusername/scholar-research.git

# Or install locally
pip install -e .

Usage

bash
# Search for a topic
python -m scholar_research "quantum computing" --top=5

# Search with custom output
python -m scholar_research "machine learning" --top=3 --output json

Supported Topics

  • Battery research (sodium ion, zinc ion, lithium, solid state)
  • Computing (quantum computing, neural networks, ML)
  • Energy (solar cells, fuel cells)
  • Health (cancer immunotherapy, CRISPR)

Development

bash
# Install dev dependencies
pip install -e ".[dev]"

#

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The supplied code is only a scoring/analysis module. It calculates credibility scores from paper metadata, sorts papers, computes score distributions/statistics, and includes helper classes that query OpenAlex and CrossRef for author/journal information. That partially aligns with the 'credibility scoring' portion of the description, but most of the declared functionality is not present in this chunk: no search across open-access sources, no paper summarization, no visualization, no timeline creation, and no figure extraction. Additionally, the code makes outbound network requests to OpenAlex and CrossRef despite the declared permissions being empty. This makes the description incomplete/inaccurate relative to the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code chunk is a search/retrieval component only. Its primary behavior is calling external academic metadata/search APIs and normalizing results. While this partially aligns with the 'search' portion of the description, the broader declared functionality is not represented in this code: there is no paper analysis, no summarization, no credibility scoring, no visualization, no timeline creation, and no figure extraction. Additionally, the declared description emphasizes peer-reviewed papers from open access sources, but the code does not enforce peer-review filtering and includes sources such as arXiv (preprints) and CrossRef/PubMed metadata endpoints that are not themselves guarantees of open-access peer-reviewed full text. Therefore the description materially overstates and mischaracterizes what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description presents a broader research skill that can search, analyze, and summarize academic papers from open-access sources and provide credibility scoring, visualization, timeline generation, and figure extraction. The supplied code only covers a subset: summarization, timeline generation, and text-based visualization over already-provided paper data. It does not perform paper search/retrieval, source access, or figure extraction, and it does not actually score credibility in the main implementation. Because important declared capabilities are absent from the actual behavior of this code chunk, the description does not accurately represent what this chunk does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises behaviors that inherently require network access, file handling, and possibly shell-capable execution through external tooling, yet it declares no explicit tool scope or permissions. This creates an overprivileged or ambiguously privileged execution model where a host may grant broader access than intended, increasing the chance of unauthorized network requests, file reads, or command execution if the implementation is later added or swapped in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 21)May include surrounding context.

md
- **Rate Limit**: 3 requests per second

### 3. OpenAlex
- **Base URL**: `https://api.openalex.org/`
- **Endpoints**:
  - Works: `/works`
  - Authors: `/authors`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 37)May include surrounding context.

md
- **Rate Limit**: 60 requests/minute

### 5. CrossRef
- **Base URL**: `https://api.crossref.org/`
- **Documentation**: https://www.crossref.org/documentation/retrieve-metadata/rest-api/
- **Rate Limit**: Polite pool (include email)
- **Note**: Requires email for "polite" usage

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 49)May include surrounding context.

md
- **Rate Limit**: 100 requests/day (free tier)

### 7. Unpaywall
- **Base URL**: `https://api.unpaywall.org/v2/`
- **Documentation**: https://unpaywall.org/products/api
- **Rate Limit**: 100,000 requests/day
- **Note**: Requires email

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/apis.md (reported line 89)May include surrounding context.

pdftotext (Poppler)

bash
# Install
sudo apt install poppler-utils

# Extract text
pdftotext paper.pdf -

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/scholar_research/figure_extract.py (reported line 67)May include surrounding context.

python
"""Extract text from PDF"""
        try:
            # Use pdftotext if available
            result = subprocess.run(
                ["pdftotext", pdf_path, "-"],
                capture_output=True,
                text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module executes the external pdftotext command on user-supplied PDF paths, which is a subprocess operation covered by the warning requirement for code files. Although the purpose is inferable, this file provides no user-facing notice, prompt, or explicit warning that external system tools will be executed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/scholar_research/figure_extract.py (reported line 103)May include surrounding context.

python
try:
            # Try using pdfimages (Poppler)
            base_name = os.path.join(output_dir, "fig")
            subprocess.run(
                ["pdfimages", "-list", "-png", pdf_path, base_name],
                capture_output=True,
                timeout=30

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code invokes the external pdfimages utility to extract images from the PDF, which is a subprocess action and also causes output files to be created in the output directory. This file does not include a confirmation, user-visible log, or explicit warning describing that behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for searching, analyzing, summarizing papers, and extracting figures from open-access sources, but this file also includes a standalone PDFDownloader that fetches remote URLs and writes PDFs into a local downloads directory. Network retrieval may support the broader skill, but bundling download-and-store behavior inside the figure extraction module goes beyond the narrower behavior claimed by this module's own documentation and the manifest's emphasis on analysis outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code fetches remote content and writes it directly to a local PDF file, which affects user storage and system state. In this file there is no confirmation prompt, user-facing notice before the write, or explanatory comment/docstring warning about the download-and-save behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This function performs an outbound request to OpenAlex using user-influenced input, creating an external transmission path. In the context of a research skill, such network access is expected, but it still represents a real privacy boundary crossing and could leak user-supplied names or research context to a third party.

Content

Scanner excerpt · src/scholar_research/score.py (reported line 227)May include surrounding context.

python
def get_author_info(self, author_name: str) -> Dict:
        """Get author info from OpenAlex"""
        try:
            url = f"https://api.openalex.org/authors?search={author_name}&per_page=1"
            response = requests.get(url, timeout=10)
            data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This function sends a user-controlled journal identifier to CrossRef over the network, which is a real external transmission of potentially sensitive query context. The skill's purpose makes this behavior functionally relevant rather than suspicious, so the primary risk is privacy/compliance exposure rather than code execution or direct compromise.

Content

Scanner excerpt · src/scholar_research/score.py (reported line 255)May include surrounding context.

python
def get_journal_info(self, journal_name: str) -> Dict:
        """Get journal info from CrossRef"""
        try:
            url = f"https://api.crossref.org/journals/{journal_name}"
            response = requests.get(url, timeout=10)
            data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The skill is designed to send search queries and metadata to external academic services such as OpenAlex. In context this is expected functionality rather than malicious exfiltration, but it still creates a real data-transmission surface that can leak sensitive user queries if not disclosed and controlled.

Content

Scanner excerpt · src/scholar_research/search.py (reported line 24)May include surrounding context.

python
"db": "pubmed"
    },
    "openalex": {
        "base_url": "https://api.openalex.org/works",
        "per_page": 50
    },
    "doaj": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 55)May include surrounding context.

md
"base_url": "https://doaj.org/api/v2/search/articles"
    },
    "core": {
        "base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/scholar_research/search.py (reported line 31)May include surrounding context.

python
"base_url": "https://doaj.org/api/v2/search/articles"
    },
    "core": {
        "base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 43)May include surrounding context.

md
"base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "limit": 50
    },
    "biorxiv": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 44)May include surrounding context.

md
"base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "limit": 50
    },
    "biorxiv": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 45)May include surrounding context.

md
"base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "limit": 50
    },
    "biorxiv": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/scholar_research/search.py (reported line 34)May include surrounding context.

python
"base_url": "https://api.core.ac.uk/v3/works"
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "limit": 50
    },
    "biorxiv": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 60)May include surrounding context.

md
"limit": 50
    },
    "biorxiv": {
        "base_url": "https://api.biorxiv.org/details/biorxiv"
    },
    "medrxiv": {
        "base_url": "https://api.biorxiv.org/details/medrxiv"