Pubmed Edirect

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 AM UTC
• Version: 0.4.4

Overview

This appears to be a legitimate PubMed/NCBI helper skill, but it needs Review because some included shell scripts and examples can mishandle untrusted inputs and the installer relies on mutable remote code.

Install only in an isolated personal research environment. Review the full NCBI installer and prefer a pinned checksum or signed release, avoid storing real NCBI API keys in shell startup files, and do not use the included batch/parallel scripts or examples on PMIDs, queries, or filenames from untrusted sources until they validate numeric PMIDs and safely escape generated commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: ADVANCED.md:133

Finding

Shell Command Injection Through Untrusted PMID Input

Content

View full analysis

abstract_{}.txt sleep 0.3 ' ``` From `EXAMPLES.md`: ```bash # Download abstracts in parallel cat pmids.txt | xargs -P 5 -I {} bash -c 'efetch -db pubmed -id {} -format abstract > {}.txt; sleep 0.3' ``` ### Technical Analysis Each line from `pmids.txt` is substituted directly into shell source passed to `bash -c`. The substituted value is not quoted, validated, or passed as a positional argument. Shell metacharacters in a crafted line are therefore interpreted as shell syntax rather than as part of a PubMed identifier. For example, a line containing a command separator can terminate the intended `efetch` command and introduce an additional command. Both the `-id` value and output filename are injection points. The documented use case only requires numeric PubMed identifiers, so accepting arbitrary shell syntax exceeds the minimum input privileges necessary for the declared functionality. ### Attack Path 1. An attacker creates, supplies, or modifies a `pmids.txt` file. 2. The file contains a line with shell metacharacters and an attacker-selected command. 3. A user or Agent runs one of the documented parallel-processing commands. 4. `xargs` substitutes the malicious line into the text of the `bash -c` program. 5. Bash parses and executes the injected command with the privileges of the user or Agent. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. Depending on that account's permissions, an attacker could: - Read or modify files available to the Agent. - Access environment variables and locally stored API cre ...[truncated 324 chars]

Remediation

View remediation

"${pmid}.txt" sleep 0.3 ' _ '{}' ``` - Reject the entire input or report the offending line when invalid data is encountered rather than silently processing it. - Prefer a shell loop or a purpose-built parallel execution mechanism that does not require dynamically generated shell source. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_fetch_abstracts.sh:31

Finding

Path Traversal and Arbitrary File Overwrite Through PMID-Derived Filenames

Content

View full analysis

"$output_file" 2>/dev/null; then # Check if we got actual content (not empty or error) if [ -s "$output_file" ] && ! grep -q "Error" "$output_file" 2>/dev/null; then echo "✓" success=$((success + 1)) else echo "✗ (empty/error)" rm -f "$output_file" ``` ### Technical Analysis The script uses each line of the input file as a filename component without validating that it is a numeric PMID. Shell quoting prevents ordinary shell command injection, but it does not prevent filesystem traversal. A value containing `../` causes `output_file` to resolve outside `OUTPUT_DIR`. Redirection occurs before `efetch` starts, so an existing accessible file can be truncated even if the network request subsequently fails. The error branch can also remove the constructed path when the output is empty or contains the string `Error`. The appended `.txt` suffix limits target selection to paths ending in `.txt`, but an attacker can still target accessible text files outside the intended output directory. ### Attack Path 1. An attacker supplies or modifies the PMID input file. 2. A line contains traversal components such as `../`. 3. The user runs `batch_fetch_abstracts.sh` with an output directory. 4. The script constructs an output path outside that directory. 5. Shell redirection truncates or replaces the targeted file with fetched output. 6. If validation of the downloaded content fails, `rm -f` may delete the targe ...[truncated 554 chars]

Remediation

View remediation

&2 fail=$((fail + 1)) continue fi ``` - Resolve `OUTPUT_DIR` to a canonical absolute directory and verify that every destination remains beneath it. - Reject path separators, control characters, leading dots, and unexpected whitespace. - Use restrictive output permissions and fail rather than overwriting existing files where appropriate, for example with shell `noclobber` or an explicit existence check. - Avoid deleting a path unless it was securely created by the current invocation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publication_trends.sh:64

Finding

Gnuplot Command Injection Through Unescaped Runtime Arguments

Content

View full analysis

/dev/null 2>&1; then echo "" echo "Generating plot..." gnuplot << EOF set terminal dumb size 80,30 set title "Publication Trend: $QUERY" set xlabel "Year" set ylabel "Publications" set xrange [$START_YEAR:$END_YEAR] set xtics 5 set key off plot "$OUTPUT_FILE" using 1:2 with linespoints EOF ``` ### Technical Analysis `QUERY`, `START_YEAR`, `END_YEAR`, and `OUTPUT_FILE` originate from command-line arguments and are expanded directly into a gnuplot program. They are not escaped for gnuplot syntax. Shell quoting at the point where arguments are initially assigned does not make interpolation into another language safe. A value containing a quote and newline can terminate an intended gnuplot string and add new gnuplot statements. Gnuplot supports execution of system commands, so code injection into the generated program can become operating-system command execution. The plotting operation only needs data values and a display title. Allowing arguments to become executable gnuplot source exceeds the minimum privileges required. ### Attack Path 1. An attacker influences the query or output filename passed to `publication_trends.sh`. 2. The supplied argument contains characters that terminate the intended gnuplot statement and introduce another statement. 3. The script completes its NCBI requests and invokes the locally installed `gnuplot`. 4. The heredoc expands the attacker-controlled value into the gnuplot program. 5. Gnuplot parses the injected statement and can execute an attacker-selected system command. Exploitation requires gnuplot to be installed and the crafted arguments to reach the script unchanged. ### Impact Assessment Successful exploitation can execute a ...[truncated 380 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: INSTALL.md:39

Finding

Mutable Remote Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: INSTALL.md:123

Finding

NCBI API Key Persisted in Plaintext Shell Startup Files

Content

View full analysis

> ~/.bashrc echo 'export NCBI_API_KEY="your_api_key_here"' >> ~/.zshrc # If using zsh ``` ### 2. Configure Email Address (Optional - identifies you to NCBI) NCBI requests that you identify yourself with an email address: ```bash export NCBI_EMAIL="[e-mail]" echo 'export NCBI_EMAIL="[e-mail]"' >> ~/.bashrc ``` ``` ### Technical Analysis The guide recommends placing the NCBI API key directly in `.bashrc` and `.zshrc`. These files are persistent, commonly included in backups and diagnostic archives, and may be read by other tools operating as the same user. Exporting the key from a global shell startup file also makes it available to subsequently launched child processes, including programs unrelated to EDirect. The optional email address is less sensitive than the API key but is exposed through the same persistence mechanism. The NCBI API key is reasonably required for increased rate limits, and its transmission to NCBI is consistent with the declared functionality. The issue is the breadth and persistence of local exposure, not the legitimate NCBI network request. ### Attack Path 1. A user follows the permanent configuration instructions and inserts a real API key into a shell startup file. 2. The key is loaded into every applicable shell session and inherited by child processes. 3. Another local process, troubleshooting bundle, backup, or accidental profile disclosure obtains the startup file or environment. 4. The API key is recovered and used without the account owner's authorization. ### Impact Assessment Exposure can permit unauthorized use of ...[truncated 404 chars]

Remediation

View remediation

> "$HOME/.ncbi-env" ``` - Load the secret only in the process or session that invokes EDirect rather than exporting it globally. - Do not commit the secret file to version control or include it in routine support archives. - Document key rotation and immediate revocation after suspected disclosure. - Ensure any secret-bearing file has mode `0600` and is owned by the intended user. - Avoid showing real API keys in command history, logs, examples, or OpenClaw execution transcripts. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (33)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · INSTALL.md (reported line 64)May include surrounding context.

Never do this:

bash

# ❌ Dangerous: Piping remote script directly to shell
curl https://example.com/install.sh | bash

# ❌ Dangerous: Executing without review
sh -c "$(curl -fsSL https://example.com/install.sh)"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · INSTALL.md (reported line 64)May include surrounding context.

Never do this:

bash

# ❌ Dangerous: Piping remote script directly to shell
curl https://example.com/install.sh | bash

# ❌ Dangerous: Executing without review
sh -c "$(curl -fsSL https://example.com/install.sh)"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · INSTALL.md (reported line 67)May include surrounding context.

curl https://example.com/install.sh | bash

❌ Dangerous: Executing without review

sh -c "$(curl -fsSL https://example.com/install.sh)"

text

**Reasons:**

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 84% confidence

Finding

Persistently writing PATH, NCBI_API_KEY, and NCBI_EMAIL into shell startup files stores configuration across sessions, and in the case of the API key places a secret in plaintext in a commonly readable configuration file. This is not a malware backdoor, but it does increase the chance of credential exposure through file disclosure, backups, shell history review, or shared account access.

Content

Scanner excerpt · INSTALL.md (reported line 109)May include surrounding context.

erify the content before execution, following best security practices.

Method 2: Manual Installation (Alternative)

If the automated script doesn't work, you can manually install:

bash

# Create edirect directory
mkdir -p ~/edirect
cd ~/edirect

# Download and extract the package
curl -O https://ftp.ncbi.nlm.nih.gov/entrez/entrezdirect/edirect.tar.gz
tar -xzf edirect.tar.gz

# Add to PATH
echo 'export PATH="$HOME/edirect:$PATH"' >> ~/.bashrc
source ~/.bashrc

Post-Installation Configuration

1. Configure API Key (For increased rate limits)

For increased rate limits (10 requests/second vs 3 requests/second), obtain an API key:

1. Create an NCBI account at https://www.ncbi.nlm.nih.gov/
2. Go to Account Settings → API Key Management
3. Generate a new API key

Add the API key to your environment:

bash

# For current session
export NCBI_API_KEY=your_api_key_here

# For permanent configuration
echo 'export NCBI_API_KEY="your_api_key_here"' >> ~/.bashrc
echo 'export

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 263)May include surrounding context.

bash

# Remove the edirect directory
rm -rf ~/edirect

# Remove from PATH in your shell configuration files
# Edit ~/.bashrc, ~/.bash_profile, ~/.zshrc, etc.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 263)May include surrounding context.

bash

# Remove the edirect directory
rm -rf ~/edirect

# Remove from PATH in your shell configuration files
# Edit ~/.bashrc, ~/.bash_profile, ~/.zshrc, etc.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The query includes english [LANG], which imposes a specific language constraint in natural-language-facing usage. Because the document does not present this as optional or explain why English-only results are required, it can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown includes a dedicated example labeled "By Language" that filters results to english [LANG], and the comment explicitly says "English articles only." This presents a natural-language locale preference without offering user opt-in or explaining a region-specific requirement, which can violate language/locale policy guidance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 100)May include surrounding context.

If the automated script doesn't work, you can manually install:

bash

# Create edirect directory
mkdir -p ~/edirect
cd ~/edirect

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 195)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 219)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 220)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 233)May include surrounding context.

bash

# On Ubuntu/Debian
sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 198)May include surrounding context.

md

sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

# On macOS with Homebrew
brew install perl

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 223)May include surrounding context.

md

sudo apt-get install perl libwww-perl libxml-simple-perl

# On CentOS/RHEL
sudo yum install perl perl-libwww-perl perl-XML-Simple

# On macOS with Homebrew
brew install perl

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 254)May include surrounding context.

bash

# Set cache directory
export NCBI_CACHE_DIR="$HOME/.ncbi/cache"
mkdir -p "$NCBI_CACHE_DIR"

Uninstallation

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The Docker example uses ncbi/edirect:latest without a fixed tag or digest, which makes the installation non-reproducible and exposes users to unexpected upstream image changes or a compromised latest tag. In an installation guide, this increases supply-chain risk because future pulls may execute different code than what was originally reviewed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says the skill is for searching and retrieving literature from PubMed, which implies a PubMed-focused literature workflow. This reference file documents use of EDirect against sequence, taxonomy, structure, ClinVar, BioProject, and other non-literature databases, materially broadening the advertised scope beyond PubMed literature retrieval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs use of network-capable tools (wget, EDirect queries to NCBI) but does not declare any tool scope such as permissions or allowed-tools. This creates a governance gap: an agent or platform may permit broader execution than intended, making network access less visible and less controllable despite the skill’s elevated-security context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Set up dedicated user accounts

### 3. Least Privilege
- Do not run as root
- Set appropriate file permissions
- Use dedicated directories for data

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains example commands that redirect output to files such as output.csv, which affects user data on disk. The surrounding documentation presents the command as a straightforward example but does not warn that running it will create or replace local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The example redirects all output to citation_network.tsv, which modifies the local filesystem. The markdown does not explicitly disclose this side effect or advise users to check whether the target file already exists.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This example writes one file per PMID (abstract_{}.txt), potentially generating many files in the current directory. The markdown lacks a warning that the command will create multiple local files and could overwrite files with matching names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The example saves remote query results into cached_query.xml, which persists retrieved data locally. The documentation does not mention that this creates a cache file or that users may want to manage or remove cached data afterward.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The function writes fetched abstracts to abstract_${pmid}.txt, creating or replacing files during batch execution. The markdown presents retry behavior but does not disclose the user-visible side effect of generating local output files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.