Security audit

Academic Research

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does academic search as advertised, but it automatically inserts a third-party promotional link into generated reviews and uses an unsafe shared temporary cache.

Review this skill before installing if you handle sensitive or proprietary research topics. Expect searches and DOIs to be sent to OpenAlex, and deep-read lookups to Unpaywall. Generated Markdown reviews include a Topanga link by default, and the cache should be moved to a private per-user directory before use on shared systems.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: scripts/literature-review.py:185
Finding: Unconditional Third-Party Promotional Content Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/literature-review.py:21
Finding: Predictable Shared Temporary Cache Enables Cache Poisoning and Symlink File Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and documents capabilities that imply network access, reading fetched content, and writing output/cache files, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what the agent may access at runtime and can lead to over-broad tool use, unintended file writes, or unsanctioned external requests when the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger language is very broad and covers generic research, synthesis, and reference-gathering requests, which increases the chance the skill is auto-selected for prompts beyond the user's intent. In an agentic environment, over-broad routing can cause unnecessary network access, retrieval of third-party content, or file outputs in situations where a simpler local response would have been safer and more appropriate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation does not clearly warn that the skill makes external network requests and may fetch full-text content from third-party URLs, including open-access PDFs or pages outside OpenAlex. Without this disclosure, users and orchestrators may not realize that invoking the skill can transmit queries externally and ingest untrusted remote content, increasing privacy and content-safety risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 76% confidence
Finding: This line transmits the paper DOI and contact email to api.unpaywall.org, creating an external data-sharing path. In the context of an academic search tool this is expected functionality, so the risk is limited, but it is still a genuine external transmission concern if users may handle sensitive or embargoed research topics.
Content: Scanner excerpt · scripts/scholar-search.py (reported line 164)May include surrounding context.
python
# Try Unpaywall for better PDF URL try: r = requests.get(f"https://api.unpaywall.org/v2/{paper['doi']}?email={MAILTO}", timeout=10) if r.status_code == 200: up = r.json() best = up.get("best_oa_location") or {}

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script transmits the user-supplied research topic and generated query variants to the OpenAlex API via HTTP requests, which can expose sensitive or proprietary research interests to a third party. In this skill context, external academic search is expected functionality, but the privacy risk remains if users are not explicitly informed that their input will leave the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script sends user-provided search terms, author names, and DOIs to OpenAlex and always attaches a hard-coded contact email via the mailto parameter, but it does not disclose this external transmission to the user. This is a real privacy/transparency issue rather than code execution risk: sensitive research topics or identifiers could be exposed to third-party services without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Deep-read mode performs an additional request to Unpaywall using the paper DOI and contact email, but this secondary data transfer is not surfaced to the user. That expands third-party exposure beyond the primary OpenAlex lookup and may surprise users who expect only one external service to receive their research inputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.