Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Sciverse academic retrieval connector that uses a user-provided API token to fetch paper metadata, text, and figures from Sciverse.
Install only if you are comfortable providing a Sciverse API token to this skill. It will send search queries, document IDs, and resource names to Sciverse endpoints to retrieve academic metadata, text snippets, citation relations, and images; some error text and schema descriptions are Chinese-only.
Several user-facing field descriptions are presented only in Chinese while other parts of the manifest are in English. This creates a forced mixed-language experience without explicit opt-in or documentation that the skill is intended for a Chinese-speaking audience.
The script emits operational error messages exclusively in Chinese when required configuration is missing. This is a natural-language locale constraint in a code file, and there is no indication that users can choose another language or that the skill is intentionally region-specific.
Comments and the user-facing error message are written only in Chinese, which imposes a specific language without offering any user opt-in or alternative. This matches the language/locale policy violation category because the file does not provide a language choice or document a justified locale restriction.
The user-facing error strings and comments are written in Chinese, and the runtime validation messages at L16 and L26 provide no alternative language or opt-in. This creates a language/locale policy issue because the skill imposes a specific language on users without offering a choice or documenting a justified region-specific constraint.
The script fetches a remote resource and emits its binary contents as base64 JSON, but the file contains no user-facing log, prompt, or explanatory comment disclosing that network data will be retrieved and returned. Because this is a code file and the operation transmits/handles remote data, the absence of any explicit warning in the code meets the missing-user-warning criterion.
The code emits a user-visible error message only in Chinese: "必须提供 doc_id 字段。" This imposes a specific language on users without any opt-in or documented locale justification, which matches the natural-language policy violation criteria.
Detected: suspicious.env_credential_access
