Security audit

SciVerse Agent Tools (Deprecated)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated academic-retrieval skill does what it claims, but it needs review because a custom endpoint setting can expose its API token and queries over unencrypted HTTP.

Prefer the renamed academic-retrieval skill if available. If installing this deprecated skill, keep SCIVERSE_BASE_URL unset or set only to an HTTPS SciVerse endpoint, never an HTTP URL, and assume research queries and requested document identifiers are sent to SciVerse along with the API token.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_common.mjs:4
Finding: Configurable API endpoint permits plaintext transmission of bearer tokens and research queries
Content: View full analysis
v !== undefined), ); init.body = JSON.stringify(cleaned); } const res = await fetch(url, init); ``` ### Technical Analysis The shared HTTP client validates only the endpoint hostname. It restricts the destination to `sciverse.space` or a subdomain of that domain, but it does not require the URL scheme to be HTTPS. Consequently, a configuration such as: ```bash export SCIVERSE_BAS ...[truncated 2549 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Error messages shown to users are written in Chinese, and the file does not indicate that language selection is configurable or user-driven. This can violate language/locale policy where tools must not force a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The validation errors for SCIVERSE_BASE_URL are emitted only in Chinese and there is no alternate language path or configuration. Forcing one locale in user-visible output without choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This user-visible error string is presented only in Chinese, again with no indication of user locale preference or configuration support. That constitutes a language policy issue under the rule when no opt-in is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file explains configuring SCIVERSE_API_TOKEN and directly invoking a semantic search tool, but it does not warn users that their queries and retrieved content will be sent to an external SciVerse service. For a skill that performs network-backed academic retrieval, a brief disclosure about external transmission of user queries/data would improve user awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest contains several input field descriptions written only in Chinese while the skill name, top-level description, and tool descriptions are in English. That creates a locale/language policy issue because users are effectively forced to understand a specific language for part of the interface without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The semantic_search query description is written only in Chinese even though surrounding manifest content is primarily English. This is a natural-language policy concern because it forces a locale choice on users without making that constraint explicit or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The read_content doc_id field description is only in Chinese while the rest of the skill metadata is mainly English. This creates an undocumented language constraint and may block users who do not read Chinese.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The helper constructs an Authorization header from SCIVERSE_API_TOKEN and sends it in fetch requests to the configured SciVerse endpoint. Although the code validates the destination domain and logs error conditions, it does not provide any user-facing notice or confirmation that credentials will be transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits a mandatory user-facing error message only in Chinese: "必须提供 doc_id 字段。" This imposes a specific language choice without offering the user an alternative or documenting that the skill is intentionally Chinese-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code emits a user-facing message exclusively in Chinese: "必须提供 query 字段。" The policy for this audit flags language or locale constraints when a skill forces a specific language without user choice, and there is no indication here of opt-in or region-specific justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/_common.mjs:4