Security audit

ScholarGraph-CancerFusionGenesResearch

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed research workflow that searches public literature, downloads papers, and creates local reports, with no evidence of hidden or destructive behavior.

Install only if you intend to use ScholarGraph with external AI/search providers. Use scoped API keys, review the unpinned xlsx dependency before installing, and adjust or confirm the output directories so generated reports are written where you expect.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The script writes an output file to a hard-coded absolute path under /root without user confirmation or configurability. In an agent/runtime context, this can cause unintended file creation or overwrite, leak sensitive workflow structure, and violate least-surprise expectations about where artifacts are stored.

Static analysis

No suspicious patterns detected.