ClawHub
Back to skill

Security audit

Semantic Scholar

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Semantic Scholar connector, but it includes unverified pipe-to-shell installer commands and overly broad routing through OOMOL.

Review this skill before installing if you are not already comfortable routing Semantic Scholar searches through OOMOL. Do not run the documented remote installer commands blindly; prefer official, pinned, verifiable installation steps and confirm any setup or authentication action yourself.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:70
Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content
View full analysis
Remediation
View remediation
/install.sh" echo " oo-installer.sh" | sha256sum --check less oo-installer.sh bash oo-installer.sh ``` The actual release URL, version, checksum, and signature-validation procedure must be supplied by the trusted vendor. ]]>

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:3
Finding

Overbroad Instruction Forces Semantic Scholar Requests Through an Intermediary

Content
View full analysis
" --data '' --json ``` Those payloads can contain search terms, paper identifiers, author names, recommendation inputs, and other user-provided query data. The reviewed file does not demonstrate collection of local credentials, environment variables, private keys, or unrelated host data; therefore, credential exfiltration is not established. The confirmed concern is unnecessary mandatory routing and the resulting disclosure of request data to an additional service provider. ### Attack Path 1. The Skill is loaded for a task involving Semantic Scholar. 2. Its description instructs the Agent to use this Skill for any such request and avoid direct API access. 3. The Agent obtains the connector schema and constructs a JSON payload from the us ...[truncated 883 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell, which is a classic supply-chain and remote code execution risk. If the install host, transport, DNS, or script contents are compromised, the agent/user could execute arbitrary code with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Semantic Scholar request," which is a very broad activation condition and does not provide constraints or exclusion examples. This can cause unintended invocation whenever Semantic Scholar is mentioned, even if the user did not intend to use this specific connector workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.