ClawHub
Back to skill

Security audit

学术论文检索小助手

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed academic paper search and citation export skill with expected network access and user-directed file output, but it has dependency hygiene and API-key handling caveats.

Install in a virtual environment, consider pinning reviewed dependency versions, use a dedicated output folder for PDFs and exports, and pass any Semantic Scholar API key only when needed while avoiding shared shell history or transcripts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises network access, local file output, and possible MCP/code capabilities but does not declare permissions or safety boundaries. This creates a transparency and policy-enforcement gap: an agent may invoke networked retrieval or write files to disk without an explicit permission model, increasing the risk of unintended data egress or filesystem modification.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The declared purpose focuses on literature search and citation generation, but the documented behavior also includes downloading PDFs and saving arbitrary output files locally. That mismatch is dangerous because users or calling agents may trust the skill as read-only/retrieval-only when it can actually modify the local filesystem, which broadens the attack surface and can enable unwanted writes.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation describes downloading PDFs and writing outputs to disk without a strong warning, confirmation step, or path restriction. In an agent setting, undocumented or weakly disclosed file writes are dangerous because they can surprise users, overwrite files, or persist untrusted content locally.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 学术论文检索小助手 - Python 依赖

# 核心检索
requests>=2.31.0
urllib3>=2.0.0

# Semantic Scholar（用于 S2 API 调用）
Confidence
92% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 核心检索
requests>=2.31.0
urllib3>=2.0.0

# Semantic Scholar（用于 S2 API 调用）
semanticscholar>=0.8.0
Confidence
97% confidence
Finding
urllib3>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
urllib3>=2.0.0

# Semantic Scholar（用于 S2 API 调用）
semanticscholar>=0.8.0

# arXiv 预印本搜索
arxiv>=2.0.0
Confidence
84% confidence
Finding
semanticscholar>=0.8.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
semanticscholar>=0.8.0

# arXiv 预印本搜索
arxiv>=2.0.0

# PubMed 生物医学文献
biopython>=1.81
Confidence
83% confidence
Finding
arxiv>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
arxiv>=2.0.0

# PubMed 生物医学文献
biopython>=1.81

# HTTP 重试
urllib3>=1.26.0
Confidence
90% confidence
Finding
biopython>=1.81

Unpinned Dependencies

Low
Category
Supply Chain
Content
biopython>=1.81

# HTTP 重试
urllib3>=1.26.0
Confidence
99% confidence
Finding
urllib3>=1.26.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
requests

Known Vulnerable Dependency: urllib3 — 10 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +7 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
urllib3

Known Vulnerable Dependency: biopython — 1 advisory(ies): CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)

Low
Category
Supply Chain
Confidence
78% confidence
Finding
biopython

Known Vulnerable Dependency: urllib3 — 10 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
urllib3

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.