cluade-scientific-writer-wrapper

• Analyzed: May 11, 2026, 4:44 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6f285970fdf48bcddbb88fbf935ebefe99315f60166b2912a4e1901cb5b3bb0a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to its reliance on an external Python package (`scientific-writer`) installed via `pip install` as instructed in `SKILL.md`. This introduces a supply chain risk, as the integrity and behavior of this third-party package are unknown and could potentially be malicious. Additionally, the `python3 -c` execution block in `SKILL.md` passes `query` and `data_files` parameters to the `generate_paper` function, which could be vectors for prompt injection against the underlying AI model or file system vulnerabilities if the `scientific_writer` library or the agent's input handling is not robustly secured.