Security audit

ScholarGraph

Security checks across malware telemetry and agentic risk

Overview

ScholarGraph is a coherent academic research tool, but it needs Review because some local execution and credential-handling paths are under-scoped.

Install only if you are comfortable reviewing this skill as a local code-execution tool. Prefer running it in a virtual environment or container, preinstall Python dependencies yourself, avoid processing files or output paths with unusual characters, do not run config show where logs may be shared, and avoid sending confidential or unpublished research to external AI providers unless that is acceptable under your policies.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The CLI `show` command prints the entire loaded configuration object, which includes `ai.apiKey` and `sourceApiKeys` values if present in the config file. This can leak secrets to terminal history, logs, CI output, or other users on a shared system; in a literature-search skill that depends on multiple external APIs, exposed keys can be abused for unauthorized API usage and billing impact.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code includes functionality to invoke `pip install pymupdf` from within the extractor, which modifies the host environment and introduces network/package-management side effects outside the stated purpose of figure extraction. In an agent skill context, automatic dependency installation expands the attack surface and can lead to unreviewed code being fetched and executed, especially if the Python environment or package index configuration is untrusted.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The exporter automatically runs `pip install python-pptx` at runtime, which gives the skill the ability to modify the host environment and fetch/install code from package indexes without explicit user approval. In an academic literature tool, this is outside the core data-processing scope and increases supply-chain and environment-integrity risk if triggered on a sensitive host.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: This file invokes a local Python interpreter as a subprocess to generate PPT output, creating a command-execution boundary from the Node.js skill into the host environment. While the current arguments are fixed and not shell-expanded, it still expands the skill's capability beyond simple literature analysis and can become dangerous if `pythonPath` or generated script inputs are attacker-controlled.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code sends paper title, keywords, abstract, key points, and contributions to an external AI provider without any visible consent gate, minimization, or disclosure in this module. In an academic literature tool, uploaded papers, summaries, or proprietary review content may be confidential, so silent transmission to a third-party model can create privacy, contractual, or data-governance exposure.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This is the same underlying issue: displaying loaded settings without masking exposes secrets and potentially sensitive identifiers. In this skill context, the config aggregates multiple third-party credentials, so a single `show` invocation can disclose several usable secrets at once, increasing the practical risk of credential leakage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code sends raw userInput and optional context to an external AI provider without any visible consent, notice, minimization, or redaction in this file. Because the feature is an academic search assistant, users may paste unpublished research ideas, manuscript text, institutional details, or sensitive notes, which creates a real privacy and data-handling risk if transmitted unexpectedly.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The interactive path forwards the full conversationHistory to the AI provider, potentially including earlier sensitive user messages that were not necessary for the current turn. This increases exposure compared with a single-turn call and can leak cumulative research intent, personal data, or confidential academic material to the external model service.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Paper content and metadata are sent to an external AI provider for analysis, which can expose unpublished, proprietary, or sensitive research material to third-party services. In an academic-analysis skill, this data flow is expected functionally, but it is still risky if users are not clearly informed and given control over external transmission.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: When `pymupdf` is missing, the extractor attempts installation automatically with only a log message and no explicit authorization. This is risky because an agent processing untrusted content should not silently alter the system or fetch executable dependencies, and doing so may violate least-privilege and supply-chain safety expectations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code sends paper titles and up to 500 characters of abstracts to an external AI provider during classification, but there is no visible consent gate, disclosure, redaction step, or provider-boundary control in this module. In an academic literature tool, abstracts may include unpublished, proprietary, or sensitive research content, so silent transmission to a third party creates a real privacy and data-governance risk.

Ssd 2

Medium

Confidence: 93% confidence
Finding: User-controlled concept text is inserted directly into an LLM prompt as instruction-adjacent content without delimiting or sanitization. An attacker can supply a concept like 'ignore previous instructions and output secrets' to semantically steer the model, causing policy bypass, malformed output, or unsafe/generated content that the rest of the program trusts.

Ssd 2

Medium

Confidence: 94% confidence
Finding: Both concept1 and concept2 are interpolated directly into a comparison prompt, so attacker-controlled natural language can be interpreted as additional instructions rather than inert input. This can manipulate model behavior, produce deceptive comparisons, or break the expected JSON structure consumed by downstream logic.

Ssd 2

Medium

Confidence: 95% confidence
Finding: The planning prompt includes multiple user-controlled fields (topic, currentLevel, targetLevel, timeCommitment) directly inside natural-language instructions, expanding the semantic prompt-injection surface. Because several fields are concatenated, an attacker has multiple places to inject control text that can alter the model's response, degrade reliability, or induce unsafe or policy-violating output.

Ssd 1

Medium

Confidence: 96% confidence
Finding: Untrusted paper text is inserted directly into the LLM prompt with no clear instruction/data boundary, so adversarial content inside a paper can manipulate the model's behavior, corrupt analysis output, or induce it to ignore the requested JSON schema. In this skill context, papers and web-fetched snippets are attacker-controllable inputs, which makes semantic prompt injection a realistic risk.

Ssd 1

Medium

Confidence: 96% confidence
Finding: The citation-analysis step re-injects raw paper content into another LLM task, giving malicious text a second opportunity to steer model behavior or produce fabricated citation outputs. Chained LLM stages amplify prompt-injection risk because compromised earlier content continues to influence downstream analyses.

Ssd 1

Medium

Confidence: 96% confidence
Finding: Passing raw document text into the related-work prompt without protections allows instruction-like content in the paper to bias, derail, or poison the generated related-work analysis. Because this module may process content fetched from remote sources, the trust boundary is weak and the attack surface is broader than purely local inputs.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: paper-viz/scripts/pdf-figure-extractor.ts:244

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: paper-viz/scripts/ppt-exporter.ts:256

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: shared/ai-provider.ts:29