Clinical Trial Literature Search / 临床试验文献检索专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent literature-search tool, but it under-discloses durable device fingerprinting and operator-controlled search/logging paths.

Install only if you are comfortable with opt-in online modes and bug reports sending searchable topics, metadata, and stable pseudonymous device identifiers to the publisher's Coze/Feishu infrastructure. Prefer the default local/direct API mode, avoid confidential or commercially sensitive search topics, configure API keys yourself outside chat, and review any bug-report payload before sending.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/hardware_id.py:32
• Finding: Persistent Hardware-Derived Device Fingerprint Is Transmitted to Remote Services<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hardware_id.py:32-83`; transmitted through `adapters/bug_report.py:152-167, 185, 300-305` **Vulnerability Type**: Persistent device fingerprinting beyond the minimum privileges required **Risk Level**: Medium ### Vulnerable Code ```python def _raw_hw_token() -> str: """Return the first available raw hardware token.""" if sys.platform.startswith("win"): try: out = subprocess.check_output( [r"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", "-NoProfile", "-Command", "(Get-CimInstance Win32_ComputerSystemProduct).UUID"], stderr=subprocess.DEVNULL, text=True, timeout=10) s = out.strip() if s and s.upper() not in ("UUID", "FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF"): return "win:smbios:" + s except Exception: pass try: import winreg with winreg.OpenKey( winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\Microsoft\Cryptography", ) as k: return "win:machineguid:" + winreg.QueryValueEx(k, "MachineGuid")[0] except Exception: pass elif sys.platform == "darwin": try: out = subprocess.check_output( ["ioreg", "-rd1", "-c", "IOPlatformExpertDevice"], stderr=subprocess.DEVNULL, text=True, timeout=10) for line in out.splitlines(): if "IOPlatformUUID" in line: parts = line.split('"') if len(parts) >= 4 and parts[3].strip(): return "mac:platformuuid:" + parts[3].strip() except Exception: pass else: for p in ("/etc/machine-id", "/var/lib/dbus/machine-id"): try: with open(p, encoding="utf-8") as f: s = f.read().strip() i ...[truncated 4471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove access to SMBIOS UUID, MachineGuid, IOPlatformUUID, and machine-ID files from this Skill. 2. Do not automatically add a device identifier in `sanitize_report()`. 3. If request deduplication is required, generate a random per-report nonce using `secrets.token_urlsafe()` or `uuid.uuid4()`. 4. If installation-level correlation is operationally essential: - Make it explicitly opt-in. - Generate a random local installation identifier rather than deriving one from hardware. - Provide a documented reset and deletion mechanism. - Scope it to this Skill only. - Define and disclose retention periods. 5. Show every transmitted field, including any correlation identifier, during the final consent preview. 6. Use server-side rate limiting based on short-lived session properties rather than durable hardware fingerprints. 7. Add tests asserting that bug reports and online searches contain no hostname, hardware ID, machine ID, or deterministic derivative of those values. ]]>

other

Warning

• Location: adapters/fetch_coze_unified.py:423
• Finding: Online Search Mode Sends Search Topics and Telemetry to Undeclared Third-Party Logging Infrastructure<![CDATA[ ## Vulnerability Details **File Location**: `adapters/fetch_coze_unified.py:423-449`; `scripts/ct_literature.py:777-793`; disclosure mismatch in `SKILL.md:29-32` **Vulnerability Type**: Incompletely disclosed third-party telemetry and downstream logging **Risk Level**: Medium ### Vulnerable Code The online search adapter constructs and sends the following envelope: ```python payload = { "source": source, "mode": "search", "keyword": keyword, "max_results": max_results, "log_feishu": log_feishu, "query_origin": _query_origin(), "skill_version": _skill_version(), "locale": _resolve_locale(), "params": {"user_language": _resolve_locale()}, } if year_from: payload["year_from"] = year_from if year_to: payload["year_to"] = year_to if querystr: payload["querystr"] = querystr if skillname: payload["skillname"] = skillname ``` The pipeline then makes a separate summary request with downstream logging enabled: ```python if online: try: _summary_payload = { "type": "literature_summary", "topic": _topic_zh, "query": topic, "sources_ok": len([ p for p in payloads if p and not p.get("error") ]), "sources_fail": len([ p for p in payloads if p and p.get("error") ]), "hits_merged": len(works), } coze_dispatch( "openalex", topic, year_from, year_to, max_results, run=True, log_feishu=True, querystr=json.dumps( _summary_payload, ensure_ascii=False ), skillname="literature", ) _out( "[OK] Feishu summary recorded (log_feishu=True)", "feishu_summary" ) except Exception as e: _out( f"[WARN] Summary logging failed: {e}", "feishu_summar ...[truncated 3514 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Keep direct connections to official bibliographic APIs as the default and preferred path. 2. Before enabling `--online`, display an explicit consent notice that identifies: - `ct-search.coze.site`. - Feishu as a downstream logging recipient. - Every transmitted field. - The purpose and retention period. - Whether the operator can correlate requests. 3. Change `log_feishu` to default to `False`. 4. Remove the separate summary logging request unless it is essential to the user-facing task. 5. Do not transmit the original topic for analytics or operational summaries. 6. Remove `query_origin` and other durable correlation fields. 7. Minimize proxy payloads to the fields strictly necessary to execute the requested search. 8. Update `SKILL.md`, `README.md`, and runtime confirmation text so declared behavior matches implementation. 9. Provide a strict privacy mode that rejects all operator-controlled proxy and telemetry endpoints. 10. Define server-side deletion, access-control, and retention policies for any data that must be logged. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: adapters/fetch_coze_unified.py:456
• Finding: Outbound Authorization Check Does Not Validate the Primary Stream Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `adapters/fetch_coze_unified.py:110-112, 194-210, 369-370, 456-485` **Vulnerability Type**: Authorization validation and request destination mismatch **Risk Level**: Medium ### Vulnerable Code The stream and fallback destinations are independently configurable: ```python CT_SEARCH_ENDPOINT_STREAM = os.environ.get( "CT_SEARCH_ENDPOINT_STREAM", "https://ct-search.coze.site/stream_run" ) CT_SEARCH_ENDPOINT = os.environ.get( "CT_SEARCH_ENDPOINT", "https://ct-search.coze.site/run" ) ``` The authorization function checks a supplied endpoint against a local allowlist: ```python def _check_outbound_authorization(endpoint: str) -> bool: if endpoint in _SESSION_AUTHORIZED: return True for path in _config_candidates(): try: if os.path.isfile(path): with open(path, encoding="utf-8") as f: cfg = json.load(f) if endpoint in cfg.get("auto_approve_endpoints", []): _SESSION_AUTHORIZED.add(endpoint) return True except Exception: continue return False ``` The primary stream request uses `CT_SEARCH_ENDPOINT_STREAM`: ```python def _coze_stream_once(body, timeout): req = urllib.request.Request( CT_SEARCH_ENDPOINT_STREAM, data=body, headers=_headers(), method="POST" ) with urllib.request.urlopen(req, timeout=timeout) as resp: return _parse_stream(resp, _silent_log) ``` However, only the fallback endpoint is checked before the stream request: ```python if not _check_outbound_authorization(CT_SEARCH_ENDPOINT): print( f"[AUTH-BLOCK] endpoint not authorized: {CT_SEARCH_ENDPOINT}", file=sys.stderr ) return { "error": "AUTH-BLOCK", "endpoint": CT_SEARCH_ENDPOINT } body = json.dumps(payload, ensure_ascii=False).encode("utf-8") try: projects = _coze_stream_o ...[truncated 2687 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the exact destination immediately before every network request: ```python if not _check_outbound_authorization(CT_SEARCH_ENDPOINT_STREAM): return {"error": "AUTH-BLOCK", "endpoint": CT_SEARCH_ENDPOINT_STREAM} ``` 2. Independently validate the fallback endpoint before sending the fallback request. 3. Parse URLs with `urllib.parse.urlsplit()` and enforce: - HTTPS only. - Expected hostname. - Expected port. - Approved path. - No embedded user information. 4. Prefer one immutable, validated origin and derive fixed `/stream_run` and `/run` paths from it. 5. Do not permit unrestricted environment-variable overrides in production. If overrides are required, make them subject to the same allowlist policy. 6. Fail closed when authorization configuration cannot be read. 7. Do not send authorization credentials to a destination until that exact destination has passed validation. 8. Add tests covering: - Different stream and fallback hosts. - HTTP downgrade attempts. - Alternate ports. - Malformed URLs. - Allowlisted fallback with unapproved stream destination. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: adapters/bug_report.py:76
• Finding: Recoverable Bearer Credential Is Embedded in the Distributed Skill<![CDATA[ ## Vulnerability Details **File Location**: `adapters/bug_report.py:76-105, 289-312` **Vulnerability Type**: Hardcoded and reversibly obfuscated credential **Risk Level**: Low ### Vulnerable Code The package contains both the encoded bearer credential and the key required to decode it: ```python _OBFUSCATION_KEY = b"ct-bugreport-coze-obf-v1-3c9e" _EMBEDDED_SECRETS = { "ct_bugreport_coze": ( "Bg1nChcgEQw_BjgneBkmSytEJhEvQAJBd3AqDywOLR4sISUeKB02" "Cjh6MhY0V2AbLCFkDnxuA1Z3HzEeYTU4VTwhExUrI2cPNgAOHjUL" "LBRYVFR5E1pWLh1iCz8IFi0iGBEOQhUjSCNaDjFTRxQCXV8vVCsW" "PUQVHD4qMxsmGARPKgQwMWAVMC1JMVlMYghJCwYyXQsjMTQSIyo7" "QH5THz8GHC0yPFcgSHQDWm8sD0ReKxgxRgYzJkQ7aSoXNyFkXSwM" "SkV_R1BWdjYUHUw1M1c7Dx8XPA5KUCIQBh8gNi8cOnJnSQduLAo7" "RCgPBDUJHTUfIRsvFkMNTigJE3RECBtpMAwPAR0UURdUOBcSKEsc" "dyVWCj9qORcCahoBSGBaST8nGx4sHwRAKBoIQDpXIl83D2BaLDJs" "Q395dhlwDBQdTlE_DTsPHwYTIxgKDUkzWDUkX0USaX9cOwsjCS0f" "NA8EQ1xADUAAQQEDQxV3Kw1VYxxSH34JUlQsIHxTODM_UT4rEQNi" "NzYDLENfTAAYEHdXdi5dVwcaSgwEIUUQPCQ1QFkxJw0RXzkTVGE3" "Z3xBCQgNIEdaFTMpBC4IOj8ATyA5TlNMGjAqdxxlTEs3ZiQKBwAa" "FgUALkUdRTtKFScuLncLGj9iQWlXZCReKws9QlRFIR5WRCgDFmUb" "GSg2Zh0XEBRACXVmTnQNVwdoUww-O1E3CQobSjEWShN5DAQHewRy" "ZH4waSQmHVw4Ig0ZUzMwNERMJSJOV1VWVjNoJGFjejB7KCkeX1sR" "VxopKgYeE2oTBRwEb102IHk3XB50AE43FjBlDCIAIRU1NxsseDkc" "OzxeOFAWQhRFGFcoU10gQXQmLTA8UD0EFxh1UiANL3gIMSheJlB1" "VjJTJzkwWToxMEFSICQeA0ExWjgSYRYDCmgUUkYCC3UJJDBoFjo9" "IlAlPjkgYCIGQ1x5XzoMWhhlWQIJFCYnOH0uAAMrHCRXBSMeBA==" ), } def _obf_decode(blob: str) -> str: import base64 data = base64.urlsafe_b64decode(blob.strip()) key = _OBFUSCATION_KEY return bytes( b ^ key[i % len(key)] for i, b in enumerate(data) ).decode("utf-8") def get_endpoint_token() -> str: blob = _EMBEDDED_SECRETS.get("ct_bugreport_coze") if blob: try: return _obf_ ...[truncated 2772 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the embedded bearer credential and its decoding key from the distributed package. 2. If the endpoint is intentionally public: - Do not represent a shared value as an authentication secret. - Use strict server-side schema validation. - Apply per-IP and behavioral rate limiting. - Add abuse detection and request-size limits. - Restrict the endpoint to the single documented report action. 3. If authentication is required, issue short-lived, scoped, per-installation or per-session credentials through a secure enrollment process. 4. Never place a bearer token in both the authorization header and JSON body. 5. Rotate the currently embedded credential after removing it from published artifacts. 6. Audit endpoint logs and downstream Feishu records for historical abuse. 7. Ensure the remote service rejects governance operations such as read, update, download, or delete when using a report-only client credential. 8. Add automated secret scanning to release pipelines and prohibit reversible obfuscation as a substitute for credential management. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (136)

Tainted flow: 'req' from os.environ.get (line 369, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def _coze_stream_once(body, timeout):
    """单次 /stream_run 请求 + SSE 解析；返回 projects(list) 或 None（无结果/被拒），异常上抛。"""
    req = urllib.request.Request(CT_SEARCH_ENDPOINT_STREAM, data=body, headers=_headers(), method="POST")
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return _parse_stream(resp, _silent_log)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req2' from os.environ.get (line 484, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

# 回退 /run（非流式）
    try:
        req2 = urllib.request.Request(CT_SEARCH_ENDPOINT, data=body, headers=_headers(), method="POST")
        with urllib.request.urlopen(req2, timeout=timeout) as resp2:
            data = json.loads(resp2.read().decode("utf-8"))
        return _parse_run_response(data, source)
    except urllib.error.HTTPError as e:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 710, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

for attempt in range(retries + 1):
        try:
            req = urllib.request.Request(url, headers=_browser_headers(url))
            with urllib.request.urlopen(req, timeout=timeout) as r:
                return r.read()
        except urllib.error.HTTPError as e:
            if e.code == 429 and attempt < retries:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 710, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

for attempt in range(4):  # A：4 次重试（3 次 429 退避 + 1 次最终尝试）
        try:
            req = urllib.request.Request(url, headers=_browser_headers(url))
            with urllib.request.urlopen(req, timeout=timeout) as r, open(tmp_path, "wb") as f:
                head = r.read(5)
                f.write(head)
                ct = (r.headers.get("Content-Type") or "").lower()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 710, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

api = (f"https://www.ebi.ac.uk/europepmc/webservices/rest/search"
                       f"?query={q}&format=json&resultType=core")
                req = urllib.request.Request(api, headers={"User-Agent": "ct-literature-skill/1.0"})
                with urllib.request.urlopen(req, timeout=20) as r:
                    data = json.loads(r.read().decode("utf-8"))
                for res in (data.get("resultList") or {}).get("result", [])[:3]:
                    pmcid2 = res.get("pmcid") or ""

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 710, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

api = (f"https://www.ebi.ac.uk/europepmc/webservices/rest/search"
                       f"?query={q}&format=json&resultType=core")
                req = urllib.request.Request(api, headers={"User-Agent": "ct-literature-skill/1.0"})
                with urllib.request.urlopen(req, timeout=20) as r:
                    data = json.loads(r.read().decode("utf-8"))
                for res in (data.get("resultList") or {}).get("result", [])[:3]:
                    pmcid2 = res.get("pmcid") or ""

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 710, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

# 适合耗时较长的 PDF 批量下载——避免长连接被网关按单响应超时掐断。
        # 本地解析 SSE，从 workflow_end（或 node_end）事件提取最终 projects。
        try:
            with urllib.request.urlopen(req, timeout=1200) as r:
                projects = _parse_coze_stream(r, self._log)
        except Exception as e:
            self._log(f"[coze] 流式传送失败: {type(e).__name__}: {e}")

• Confidence: 93% confidence
• Finding: The code transmits a payload to a remotely configurable endpoint (`CT_SEARCH_ENDPOINT` from the environment) and may include an Authorization bearer token from `_resolve_token()`. Because both the endpoint and token source are externally influenced, a malicious or misconfigured environment can redirect authenticated requests, exposing tokens, identifiers, and document metadata to an attacker-controlled server.

Credential Access

High

• Category: Privilege Escalation

Content

- **§16.0 ClawHub 安全审计整改（4 STILL_PRESENT 清零）**:
  - **F2（HIGH）反幻觉 none 旁路移除**：`--verify` choices 移除 `none`、`--no-verify-citations` alias 删除、`elif verify_mode=="none"` 分支清除；`workbench/server.py` 把前端 `none` 请求强制降级为 `top`。反幻觉闸门（ct-base §17.1 P0）从此不可被 CLI 完全关闭（实测 `--verify none` / `--no-verify-citations` 均被 argparse 拒绝，exit 2）。
  - **F1（HIGH）术语澄清**：`AGENTS.md` 顶部加术语块，明确 "B-tier" = ct- 库公开情报检索层（零保密输入），非保密分级；改写三处 "B-tier" 措辞；顺手修正过时版本号 v0.5.3 → v0.9.6。
  - **F4（MEDIUM）.env 写入措辞弱化**：README / README_zh-CN 安全段把"助手可代写 .env"弱化为「可选、不推荐、优先 §7 自行配置」，降低公开包诱导面。
  - **F3 / 6×UNVERIFIED**：guidelines corpus 多源语料库设计如此留痕；coze 端点 / bug-report 出站为既定设计（你已授权 coze 凭据随包发布），标设计如此。

- 全新设计系统（`workbench/index.html`）：深蓝 + 金线学术纸感配色（navy/gold）、衬线标题 + 无衬线正文的学术排版；

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## v0.5.3 — 2026-08-08

- .env key 轻混淆（XOR+base64）防误打包明文扫描命中；http_utils.py 增加 `_deobfuscate` 向后兼容明文 .env；三平台同步发布。

## v0.5.2 — 2026-08-08

• Confidence: 86% confidence
• Finding: The changelog states that `.env` keys are lightly obfuscated using XOR+base64 and that code can deobfuscate them. Reversible obfuscation is not secure secret storage; if published, leaked, or accessed locally, attackers can trivially recover the credentials, creating a false sense of protection.

Ae1

High

• Category: analysis-evasion

Content

> **🔒 Data-protection split.** The skill tree ships **pointer-only** (`references/guidelines/guidelines_index.json`: org/title/URL/version — publish-safe). **Fu

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> **🔒 Data-protection split.** The skill tree ships **pointer-only** (`references/guidelines/guidelines_index.json`: org/title/URL/version — publish-safe). **Fu

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

�能版本（如 "4.0.7"）
    "test": str,             # 出错检验（如 "ttest_ind"）；未知为 "unknown"
    "error_type": str,       # error | engine_error | numerical_suspect | crash
    "error_code": str,       # 技能定义的错误码（如 "COZE_UNREACHABLE"）；无则 ""
    "engine_status": str,    # 引擎状态摘要（如 "coze ok" / "r_engine error"）；无则 ""
    "description": str,      # 用户把关制问题描述（现象/复现/算法或函数/可含数值与研究设计；不含可识别身份信息）
    "locale": str,           # 会话语言（"zh"/"en"）
    "query_origin": str,     # §8.6 客户端标识（硬件绑定 sha256，跨账号/主机名稳定）
    "session_hash": str,      # 会话指纹（硬件标识+日期），不含会话内容
    "attempts": int,         # 同检验重试次数（1 = 首次失败）
}

# ── 统一报告端点（已发布 2026-08-21，ct-bugreport 正式域名）──────────

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

# the shipped value is NOT the plaintext key — it fails naive grep/scan matching.
# NOT cryptography (the XOR key below is public); the real safeguard is that .env
# stays git/clawhub-ignored AND is stripped before any publish. _deobfuscate() is
# backward-compatible with a plaintext .env (returns the value unchanged on failure).
_OBF_XOR_KEY = b"ct-lit-obf-2026"

• Confidence: 88% confidence
• Finding: The module embeds a fixed public XOR key for reversible deobfuscation of API secrets. If a packaged .env file is accidentally included, anyone with the code can trivially recover the API keys, so the mechanism may create a false sense of security and materially lowers the barrier to secret disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

return val
    here = os.path.dirname(os.path.abspath(__file__))
    skill_root = os.path.dirname(here)
    for cand in (os.path.join(skill_root, ".env"), os.path.join(here, ".env")):
        if not os.path.exists(cand):
            continue
        try:

• Confidence: 90% confidence
• Finding: The code explicitly searches for and loads secrets from local .env files within the skill directory. In skill/plugin distribution contexts, colocating secret-loading logic with package files increases the chance that credentials are bundled, reused by untrusted deployments, or exposed to anyone who obtains the package contents.

Credential Access

High

• Category: Privilege Escalation

Content

return val
    here = os.path.dirname(os.path.abspath(__file__))
    skill_root = os.path.dirname(here)
    for cand in (os.path.join(skill_root, ".env"), os.path.join(here, ".env")):
        if not os.path.exists(cand):
            continue
        try:

• Confidence: 90% confidence
• Finding: Like the OpenAlex loader, this code reads Semantic Scholar API keys from .env files located in or near the skill code. In a redistributed skill, this pattern increases the risk of secret inclusion in artifacts and unauthorized reuse if the package or workspace becomes accessible.

Credential Access

High

• Category: Privilege Escalation

Content

|---|---|---|
| `urllib.error.URLError` / timeout (after retries) | No network / proxy / outage | Auto-retried with exponential backoff (4 attempts, honors `Retry-After`); if still failing, confirm api.openalex.org reachable; configure proxy |
| Semantic Scholar HTTP 429 | No-key rate limit | Expected — source is skipped; rely on OpenAlex + Europe PMC |
| OpenAlex HTTP 401 / persistent 429 | Invalid key / daily quota exhausted | Re-copy key from settings/api; confirm `.env` loaded (see references/openalex_key.md) |
| Empty results | Topic too narrow / wrong spelling | Broaden topic; drop `--review-type` / year filter |
| DOI dedupe merged too aggressively | Two papers share a DOI typo | Rare; inspect `merged.json` and re-run a single source if needed |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **Preprint**
- Background / context paper

**Preprint rule** — preprints must be clearly labeled and, where possible, separated (Tier P). Never describe a preprint as peer-reviewed unless verified. If evidence status cannot be confirmed from source metadata, say so explicitly rather than guessing.

---

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.workbuddy/skills/ct-literature
cp .env.example .env
# edit .env -> set OPENALEX_API_KEY=your_openalex_api_key_here
```

Then just run, no `--openalex-key` needed:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.