Security audit

Paid Database Access

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-built for academic database automation, but it needs careful review because it can use logged-in browser sessions, copy cookies, store abstracts, and send paper data to external AI APIs.

Install only if you are comfortable letting an agent operate inside a logged-in academic browser session. Use a dedicated browser profile with only the target database accounts, avoid cookie_bridge unless you explicitly want cookies copied, check your institution's terms, configure AI providers deliberately, and assume paper metadata and abstracts may be sent to external APIs and retained in local memory caches until you delete them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: """Attempt to pip install a package.""" print(f" ... 正在安装 {package_name}...") try: result = subprocess.run( [sys.executable, "-m", "pip", "install", package_name], capture_output=True, text=True, timeout=120 )
Confidence: 94% confidence
Finding: The --fix path executes `python -m pip install <package>` from within the skill, which causes arbitrary code from downloaded packages to run during installation. In this skill’s context, the feature is especially sensitive because it is part of a browser/cookie-bridge workflow that already interacts with authenticated user environments; a compromised dependency or package-source hijack could lead to code execution on the user host.

Tainted flow: 'req' from os.environ.get (line 189, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: try: with urllib.request.urlopen(req, timeout=30) as resp: raw = resp.read().decode('utf-8')
Confidence: 92% confidence
Finding: The request URL and credentials are influenced by environment/config-derived values and then used in an outbound network call. In this skill context, that creates a real exfiltration and trust-boundary risk because paper metadata and rerank reasons are sent to whatever base URL is supplied, including attacker-controlled endpoints if the environment or config is poisoned.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The skill instructs persistent local storage of abstracts and metadata in cache files without clearly limiting retention, sensitivity, or user awareness. Even if the content is academic, cached files can include licensed material, search intent, institutional-access-derived content, and bibliographic data that may be sensitive or contractually restricted. The risk is elevated because the storage is central to the workflow and appears automatic rather than explicitly consented to.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script accepts an arbitrary --dir path and then enumerates files in that directory, printing names, sizes, timestamps, and full paths. In the context of a skill meant to bridge access to paid academic databases, this expands access into unrelated local filesystem areas and can expose sensitive local metadata if an agent invokes it on non-download folders.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The script writes persistent match results containing local file metadata, paths, and paper associations to memory/.download_match.json. That creates a durable record of the user's local downloads and research activity beyond the immediate task, which is especially sensitive given this skill handles authenticated academic database access and could reveal reading history or downloaded documents.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script reads API credentials from broad environment variables and personal OpenClaw configuration files that are outside the skill’s stated database-access purpose. In an agent-skill context, this expands trust boundaries and allows the skill to opportunistically reuse unrelated user secrets for outbound network access without explicit consent.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script transmits research topics, paper metadata, and abstracts to an external LLM API, which materially exceeds a database-bridging/local-processing expectation. In this skill context, academic queries and retrieved content may be sensitive, licensed, or subject to usage restrictions, so silent exfiltration to a third party creates significant confidentiality and compliance risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script automatically pulls API credentials from global environment variables and OpenClaw config files unrelated to the immediate task, which expands its authority beyond explicit user input. In an agent-skill context, this can cause unintended credential reuse and silent exfiltration of paper contents to a third-party endpoint chosen via ambient configuration rather than an intentional per-run decision.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as a bridge to paid academic databases via the user's authenticated browser session, but this script also sends article identifiers to third-party free APIs. That creates undisclosed external data flows and expands the trust boundary beyond the described paid-database workflow, which is risky in a skill that handles potentially sensitive research activity.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script persists abstracts plus title, authors, venue, DOI, citations, and other metadata into a shared local cache under memory/paper-abstracts for reuse across queries. In a skill designed to bridge into paid databases using a user's session, cross-query retention of retrieved content can violate least-retention expectations and may retain licensed or sensitive research data longer than users realize.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file claims abstracts are handled with "Zero context pollution" and are never printed or passed onward, but in themed RIS export it appends up to 500 characters of the abstract into the N1 note field, and BibTeX export can include the full abstract as well. In this skill context, abstracts may come from paid academic databases accessed via a user's authenticated browser session, so this mismatch can leak licensed or sensitive content into exported artifacts or downstream tools contrary to user expectations.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The script documents `--check` as read-only but still writes to `config.yaml` via `update_config_cache(results)`. This violates operator expectations and can be abused as a stealthy state-changing action, which is particularly concerning in a skill that brokers access to paid databases and browser login state.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The script searches broad ambient sources for API credentials, including environment variables and a home-directory config, even though thematic clustering is ancillary to the stated paid-database bridge purpose. This increases credential exposure and makes the component unexpectedly capable of using unrelated secrets present on the host.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: This file introduces an external LLM transmission and processing step that is broader than the manifest’s described search/extract/rank pipeline. Hidden or undocumented data egress is security-relevant here because the skill handles potentially sensitive research activity and borrowed authenticated access workflows.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The quickstart explicitly promotes taking over a user's institutional browser login session and extracting data from paid academic platforms, but provides no warning about privacy, account suspension risk, institutional policy violations, or session-token sensitivity. In this context, the omission is dangerous because the skill is designed around reusing authenticated browser state, which can expose cookies, authenticated content, and user-linked activity to the agent and any downstream tooling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Passing the Scopus API key directly on the command line can expose the credential through shell history, process listings, terminal logs, CI logs, or agent transcripts. Because this skill is automation-oriented and may run in shared or monitored environments, the risk of accidental credential disclosure is materially higher than in a purely local manual workflow.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly states the tool connects via Chrome DevTools Protocol to a browser session that is already authenticated and then acts as the user against paid databases, but it does not clearly warn that this grants the agent effective access to the user's live session, institutional subscriptions, and potentially any session-scoped data visible in that browser context. In this skill context, that omission is especially dangerous because the entire design centers on session borrowing and automation against authenticated resources, so users may underestimate the privacy, account, and compliance risks.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The README lists a Scopus API key as a dependency but does not provide guidance on secure storage, non-logging, rotation, or avoiding hardcoding and accidental disclosure. In a skill that already bridges into paid data sources, poor credential-handling guidance increases the chance of credential leakage, misuse of paid API quotas, and unauthorized access under the user's or institution's account.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow writes persistent abstract/cache files but does not provide an explicit user warning about local data storage. This matters because the cached material may be derived from paid databases or user-authenticated sessions, and users may not expect durable copies to remain on disk after the task completes. Lack of notice weakens consent and increases the chance of accidental retention or secondary exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly reuses the user's logged-in paid-database browser session via CDP, but does not present a strong privacy/account-use warning. This is dangerous because it authorizes automated actions under the user's institutional identity, potentially exposing licensed content, search history, account context, or triggering terms-of-service violations without clear consent. The skill context makes this more dangerous, not less, because the entire design depends on borrowing authenticated access that AI otherwise would not have.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script is explicitly designed to run inside an authenticated Scopus browser session and extract metadata from pages reached via the user's institutional SSO state. Even though it does not steal credentials directly, it leverages paid-session access without any in-script consent, disclosure, or scope guard, which creates a real risk of unauthorized data harvesting from a licensed resource and privacy/compliance issues for the user or institution.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The outbound API call sends the research topic and paper content to a third-party service without any in-band warning, acknowledgement, or consent gate. In a paid academic database skill, this is more dangerous because the data may contain proprietary abstracts, user research interests, or institution-linked access-derived material.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code sends titles, authors, venues, years, and potentially full abstracts to an external chat-completions API without a clear just-in-time warning or confirmation. In this skill's context, the data originates from paid academic sources and borrowed user sessions, so silent transmission to a third-party LLM provider materially increases privacy, contractual, and data-handling risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The commands output path interpolates a user-supplied `scopus_api_key` directly into a shell-style command line. If a real key is placed there, it can be exposed through terminal history, logs, transcripts, screenshots, process listings, or downstream agent/tool traces. In this skill's context, which bridges paid academic database access and browser-based authenticated sessions, credential handling is especially sensitive because it operates around subscription-gated resources and may normalize unsafe secret-passing practices.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends paper titles and AI rerank reasons to an external API without any explicit warning or consent checkpoint. In a paid academic database access skill, search terms, titles, and ranking rationales can reveal user research interests, institution activity, or licensed-content usage patterns, making silent outbound transfer meaningfully risky.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.