Security audit

SciVerse Agent Tools (Deprecated)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated SciVerse skill is a straightforward academic-paper search helper that uses a disclosed API token and shows no hidden or destructive behavior.

Install only if you are comfortable providing a SciVerse API token and sending your paper searches, document IDs, and requested content ranges to SciVerse. This slug is deprecated, so prefer migrating to academic-retrieval as the skill documentation recommends.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/_common.mjs:4