T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pipeline/ai_rerank.py:173- Finding
Academic abstracts and API credentials can be transmitted to an unrestricted external LLM endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Paid Database Access
Security checks for vulnerabilities and agentic risk
Overview
This skill automates paid academic database research, but it also handles browser sessions, cookies, API keys, and abstracts with under-disclosed and overbroad security impact.
Install only if you are comfortable giving the skill access to authenticated academic database sessions and research artifacts. Avoid the cookie extractor/bridge unless you fully understand that cookies are active login credentials; do not paste cookie values into ordinary config files or logs. Review and pin the LLM base URL/provider before running rerank, summarize, or theme clustering, because paper metadata and abstracts may be sent outside your machine.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils/cookie-extractor.py:217- Finding
Authentication cookies are printed in plaintext and recommended for plaintext configuration storage
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/utils/cookie_bridge.py:54- Finding
Cookie bridge copies an overbroad set of browser sessions into the automation profile
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pipeline/scopus_search.py:47- Finding
Scopus API key is exposed in the request URL despite already being sent in a header
- Content
View full analysis
dict: encoded = urllib.parse.quote(query) url = (f"https://api.elsevier.com/content/search/scopus" f"?query={encoded}&apiKey={api_key}" f"&count={count}&start={start}&sort={sort}") headers = {"X-ELS-APIKey": api_key, "Accept": "application/json"} req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=timeout) as resp: raw = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The API key is placed in both the `X-ELS-APIKey` header and the URL query string. The query-string copy is unnecessary because the authenticated header is already present. URLs are more frequently retained than request headers. Potential retention points include: - Forward and reverse proxy logs. - Server access logs. - Network observability platforms. - Exception messages. - Debugging tools. - URL histories and telemetry. - Monitoring systems that record complete request targets. TLS protects the URL in transit from ordinary passive network observers, but it does not prevent disclosure to endpoints and infrastructure that terminate or instrument TLS. ### Attack Path 1. The user invokes the Scopus search script with a valid API key. 2. The script constructs a URL containing `apiKey=`. 3. A proxy, telemetry service, server, or diagnostic system logs the complete request URL. 4. An attacker or unauthorized operator obtains access to the retained logs. 5. The attacker extracts the key from the `apiKey` parameter. 6. The attacker submits requests to the Elsevier API using the stolen key. ...[truncated 436 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/pipeline/setup.py:178- Finding
Setup repair mode installs unpinned packages from the active package index
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (105)
Tainted flow: 'req' from os.environ.get (line 189, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: with urllib.request.urlopen(req, timeout=30) as resp: raw = resp.read().decode('utf-8')
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个较完整的学术数据库访问与内容处理管线，覆盖 IEEE/Scopus/EV/ACM、多步搜索与结果处理，并借用用户登录态作为权限桥接。实际代码则是一个非常具体的 ACM 页面下载链接提取器：读取当前详情页 DOM、识别下载/阅读链接、去重，并在缺失时按 DOI 构造 PDF URL。虽然它与“借用浏览器登录态访问 ACM 页面”这一大方向有弱相关性，但其实际功能范围远小于声明，且缺少声明中的核心能力（搜索、摘要处理、评分、多数据库支持）。因此属于明显的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broader academic-database access bridge for specific paid platforms (IEEE, Scopus, EV, ACM) with end-to-end workflow features: using browser CDP and user login state, searching, extracting, deduplicating, filling in abstracts, scoring, and outputting results. The supplied code instead is a narrow extractor for CNKI search result pages. It parses a specific HTML table on CNKI, infers document type from table cells, and returns metadata. There is no evidence of CDP session bridging, no interaction with IEEE/Scopus/EV/ACM, and none of the higher-level pipeline steps like deduplication, abstract supplementation, or scoring. This is a material description-behavior mismatch, not just an implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description presents a broader academic-database access bridge focused on specific providers (IEEE/Scopus/EV/ACM) and a full pipeline including search, deduplication, abstract supplementation, and scoring. The supplied code chunk is a narrow DOM scraper for Web of Science search results. While extraction is part of the declared workflow, this chunk accesses a materially different resource (WoS, not the listed databases) and lacks the distinctive behaviors highlighted in the description, especially abstract handling and CDP-based session bridging. That makes the description inaccurate for this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a network/browser-based academic database access and retrieval pipeline. This code does not implement any of those core behaviors. It only accesses the local filesystem, enumerates recent downloaded files, optionally searches for an exact filename, matches filenames against supplied paper titles using simple token overlap, and writes a local JSON cache of match results. While downloaded-paper matching could be a supporting utility in a larger academic-paper workflow, the declared purpose specifically emphasizes CDP-based session reuse, paid database search/access, extraction, deduplication, abstract filling, and scoring; none of these are present in the supplied chunk. Therefore this code chunk materially differs from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description and code are materially different. The declared purpose describes a database-access/search bridge layer that uses browser CDP and user authentication to query paid academic sources and process results end-to-end. The supplied code does none of that. It is a local monitoring/diff tool for previously generated result files, storing monitor configs and baselines under memory/monitors and exposing CLI commands to create, inspect, diff, save, suppress, and delete monitors. The file header even states it 'never participates in search pipeline.' This is not a supporting subcomponent of the declared bridge/search functionality; it is a separate feature with a different primary purpose and different resources/triggers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full academic-database access and retrieval pipeline: connecting through browser CDP, leveraging the user's authenticated session, searching multiple paid sources, extracting records, deduplicating them, supplementing abstracts, scoring results, and producing output. The supplied code does none of that. It is a standalone Python script for post-processing already-produced paper JSON files by stripping abstract fields or emitting a metadata-only summary. While the script loosely relates to the declared phrase 'zero-token abstract handling,' that is only one small aspect and does not make the overall description accurate. The primary purpose and capabilities are materially different, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on a browser-based authentication bridge into paid academic databases and an end-to-end retrieval pipeline. This code chunk does none of that. It is a post-processing/reranking component: it consumes already-enriched paper records, loads abstracts from local cache/files, calls a remote LLM API for semantic scoring, adds tags/metadata, and writes ranked output. While 'scoring' and handling abstracts are loosely related to part of the declared pipeline, the primary purpose and resource access are materially different, and key claimed capabilities—CDP login-state borrowing, database querying, search, extraction, and deduplication—are absent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents this skill as an access bridge for paid academic databases that leverages browser CDP and a user's authenticated session to search and retrieve papers, then post-processes them through extraction, deduplication, abstract completion, and scoring. The supplied code does none of that. It is narrowly focused on AI summarization: it loads papers from an input JSON, optionally reads local abstract files, constructs prompts, calls a chat-completions API, and stores generated Chinese summaries in the output. While the description mentions 'zero-token abstract handling,' the code's behavior of reading abstracts from files and avoiding broader context only loosely overlaps and does not make the overall description accurate. The primary purpose and capabilities are materially different.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a database-access bridge that uses browser CDP and authenticated sessions to query paid academic sources and run a broader retrieval/enrichment pipeline. The supplied code does none of that. It only operates on local files: it loads enriched.json, inspects referenced abstract text files, checks abstract length, reports completeness, and generates a Tier 2 task JSON if too many abstracts are missing. While abstract-related handling is loosely related to the broader pipeline, this chunk’s actual primary function is integrity checking and workflow routing, not paid-database access or browser-session bridging. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a database-access and retrieval pipeline centered on authenticated browser-based access to paid scholarly platforms, followed by search, extraction, deduplication, abstract completion, scoring, and output. The supplied code instead operates entirely locally: it parses JSON inputs, validates schema, computes tier labels from preexisting score fields, reads abstracts from local files, formats metadata, and writes BibTeX/RIS. The header explicitly says 'no browser, no login, no network,' which directly contradicts the declared browser/CDP/database-access purpose. While there is limited overlap with 'output' and some abstract handling, the main behavior is materially different and lacks the core declared capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a paid-database access bridge centered on browser/CDP session reuse and downstream literature-processing steps. The provided code chunk is materially different: it is a lightweight preflight validator that calls the free OpenAlex API to estimate whether a query is too narrow or too broad before later stages. This is not merely a supporting low-level detail of the declared behavior; its primary purpose, accessed resource, and operational method are different from the description. The code neither touches paid databases nor uses browser state, and it lacks the extraction/dedup/abstract/scoring functions claimed in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad capability: connecting to paid academic databases through browser CDP, reusing user login state, then searching, extracting, deduplicating, enriching abstracts, scoring, and outputting results. The supplied code chunk does not implement those access or acquisition behaviors. Instead, it operates on an already-produced local JSON dataset (
themed.json) and formats the final Markdown report. It does include limited abstract fallback handling and scoring/tiering for presentation, which are consistent with a downstream output stage, but the primary behavior is materially narrower and different from the declared purpose. Therefore this chunk does not accurately represent the declared skill functionality.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a much broader acquisition pipeline component: borrowing a user's browser login state via CDP to access subscription databases, search them, extract papers, fill missing abstracts, score results, and output ranked data. The supplied code does none of that. It only reads already-produced JSON results, deduplicates/merges paper records by DOI and fuzzy title, normalizes type labels, validates schema, and writes an output file. The script explicitly states that scoring is handled elsewhere and that it only does load → deduplicate → write. This is a material description-behavior mismatch in primary purpose and capabilities, not merely an incomplete snippet of the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a database-access bridge that leverages a user's authenticated browser session to query paid academic sources and run a broader search/extract/deduplicate/score pipeline. The supplied code does not do any of that. It is a standalone merge utility for Tier 2 results: it loads JSON files, matches result entries to existing papers using docId/DOI/title similarity, writes abstract text to local files, updates references in enriched.json, and saves output. While '补摘要' (filling abstracts) is tangentially related, the primary behavior is local data merging and file management, not authenticated database access or browser automation. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents this skill as an access bridge to paid academic databases that uses browser CDP and the user's login state to search and retrieve papers, then deduplicate, enrich abstracts, score, and output results. The supplied code chunk does something much narrower and materially different: it operates only on an input JSON file of already-merged papers and performs metadata normalization, multi-dimensional scoring, tagging, sorting, summary logging, schema validation, and optional file output. There is no network/database access, no browser automation, no CDP, no session reuse, no extraction from IEEE/Scopus/EV/ACM, no deduplication implementation, and no abstract backfilling. This is a clear description-behavior mismatch, although the scoring/output portion is partially aligned with the latter part of the declared pipeline.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a full academic-database access and processing pipeline: using browser CDP to reuse a logged-in user session, searching paid databases, extracting records, deduplicating them, filling in missing abstracts, scoring, and outputting results. The supplied code chunk does something much narrower: it builds search queries from structured JSON for several databases and prints them as URLs, strings, JSON, or command suggestions. While it references downstream scripts and browser actions in notes/printed commands, this code itself does not perform those actions. Therefore the code’s actual behavior is only a query builder component, which is materially narrower and different from the declared end-to-end bridge/search/extraction/scoring system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents a much broader and different system: a permission-bridging layer for paid academic databases via browser CDP and user login state, covering IEEE/Scopus/EV/ACM and including post-processing such as abstract completion and scoring. The supplied code does none of that. It only performs direct HTTP requests to the Elsevier Scopus Search API with an explicit API key, paginates results, normalizes a small metadata subset, deduplicates by DOI, and saves output. While deduplication and search/output are consistent with part of the description, the primary access mechanism, scope of databases, and several claimed processing steps are materially absent, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向付费学术数据库的数据访问与处理流水线，而该代码块并未执行任何数据库搜索、内容提取、摘要补全、去重或评分逻辑。它的主要用途是安装前/运行前环境自检与修复，属于配套运维脚本，不是声明中的核心功能实现。虽然代码中提到 cookie bridge、浏览器引擎、数据库连通性、extractors 文件等，与整体项目背景有关，但这些只是在为后续功能做准备。更重要的是，代码具备声明未提及的能力：调用 pip 安装包、写回 config.yaml、探测本机浏览器与网络状态。因此，描述与该代码块的实际行为存在明显且实质性的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes an authentication/access bridge for paid academic databases using browser CDP and user session borrowing, plus a full retrieval pipeline (search, extract, dedupe, abstract补全, scoring, output). The supplied code does none of that. It operates on already-provided paper JSON input, clusters the top papers by theme using an external chat-completions API, adds _theme annotations, and writes structured output. Its primary purpose is thematic post-processing, not database access or retrieval. The only network access present is to a configured LLM endpoint, which is not mentioned in the declared purpose. Therefore the description materially misrepresents the code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a system for bridging authenticated access to paid academic databases through browser CDP, reusing a user's login state, and performing a multi-step scholarly retrieval pipeline. The supplied code does none of that. It is a narrow utility focused on querying the public arXiv API over HTTP, parsing Atom-like XML text, selecting the best title match, applying DOI-based verification/rejection, and emitting arXiv metadata and optional PDF URLs. There is no browser automation, no CDP usage, no authenticated session handling, no interaction with IEEE/Scopus/EV/ACM, and no abstract processing. This is a clear material mismatch in both primary purpose and accessed resources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full academic-database access bridge that leverages browser CDP and user login state to search databases and process results. The supplied code does not implement any of that pipeline. Instead, it is a cookie-processing helper: it accepts cookie text from a file/stdin/interactive paste, parses name/value pairs, validates presence of required cookies for selected databases, and emits a compact cookie header string or JSON. While cookies and login state are related to the broader declared system, this chunk’s actual primary purpose is manual cookie extraction and formatting, not CDP-based authenticated browsing or literature retrieval/processing. Therefore this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code does relate to session transfer for academic database access, so it is partially aligned with the broad idea of a 'permission bridge.' However, the declared description specifically says access is bridged 'through browser CDP' and suggests a larger end-to-end academic search/extract/rank workflow. This code does not use CDP at all; instead it directly accesses local browser files, extracts encryption keys from Chromium Local State, decrypts cookies, and injects them into another browser profile. That is a materially different mechanism with stronger local credential-handling behavior than described. In addition, none of the claimed downstream functions—search, extract, deduplicate, supplement abstracts, score, or zero-token abstract handling—are present in this chunk. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该代码片段的实际职责是一个狭窄的 DOI 工具模块，属于论文处理系统中的辅助实现细节，而不是声明所描述的“权限桥接层”或完整学术数据库抓取/处理流水线。虽然 DOI 提取、匹配、标题相似度可作为去重或标识管理的支持能力，但片段完全没有任何浏览器自动化、CDP 会话复用、认证态访问、数据库检索、摘要抓取/补全、评分或结果输出逻辑。因此，就此代码片段而言，声明描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a database-access and paper-processing bridge that uses browser CDP and user session state to retrieve and process academic papers. The supplied code does none of that. It is a utility module for pipeline schema validation: it checks whether paper dictionaries contain expected fields for named stages, writes issue reports to memory/pipeline_issues.json, stamps metadata, and checks pipeline version compatibility. While some stage names reference search/enrichment/ranking/summarization, this file only validates outputs from those stages; it does not implement the described bridge behavior. Therefore the description materially misrepresents the actual code's primary function.
- Content
Static analysis
No suspicious patterns detected.