sn-search-academic

• Outcome: Review
• Latest audit: Aug 19, 2026 · 3:36 AM UTC
• Version: 2026.8.19

Overview

This academic-search skill mostly matches its stated purpose, but it needs review because some fallback paths use browser-disguise/location spoofing, implicit token registration, and broad local file writes.

Install only if you are comfortable with research queries being sent to multiple external scholarly services, optional writes to user-supplied file paths, browser-automation crawler fallbacks that spoof browser environment details, and DeepXiv SDK behavior that can obtain a token automatically. Prefer using explicit --source selections, safe output directories, and pre-provided API tokens; avoid enabling crawler fallbacks unless you accept the Camoufox/Playwright behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to use shell commands, access environment-provided credentials, write output files, and make network requests, but it declares no permissions boundary. That mismatch is dangerous because it can cause an orchestrator or reviewer to underestimate the skill's real capabilities, especially since the skill explicitly references API keys, cookies, `.env`, external services, package installation, and filesystem output.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script is explicitly built around Camoufox browser disguise and anti-detection behavior for a simple arXiv search task, which is disproportionate to the stated academic-search purpose. Evasion tooling reduces transparency, can bypass site bot-detection controls, and makes the skill easier to repurpose for stealthy scraping or other abusive automation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code grants geolocation permission and injects fabricated coordinates even though academic search on arXiv does not require location access. Unnecessary permission grants and spoofed location increase fingerprint manipulation, weaken user privacy expectations, and indicate the browser context is being shaped to evade detection rather than support the declared function.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill advertises academic search/query behavior, but it also exposes PDF download and local file write functionality. That expands the operational scope from metadata retrieval to network download plus filesystem modification, which can surprise callers, bypass expected review, and increase risk in agent environments where tools are trusted based on declared scope.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The code comments claim the PDF download interface is hidden and not exposed, but the CLI explicitly exposes it via a `download` subcommand. This discrepancy undermines transparency and can cause reviewers or orchestrators to miss a capability that performs network retrieval and file writes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: When no token is supplied, the script invokes SDK logic to automatically register a new DeepXiv token. That introduces external account/token acquisition behavior beyond simple paper retrieval, can create undisclosed third-party state, and may violate least surprise for users running an academic reading tool. In this context it is not overtly malicious, but it is still security-relevant because it performs identity/bootstrap actions without explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The script exposes an --output parameter that writes JSON to any resolved filesystem path, which exceeds the narrowly described paper-reading purpose and can modify local files. In an agent setting, arbitrary file-write capability can be abused to overwrite user files, drop data into sensitive locations, or stage follow-on attacks if higher-level orchestration passes attacker-influenced paths.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code writes to an arbitrary caller-supplied path using Path(...).resolve() and write_text() without confinement, making the skill capable of filesystem modification unrelated to simple academic lookup. In agent workflows, that broad capability is dangerous because untrusted prompts or upstream tools may influence the destination path.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI accepts an arbitrary --output path and writes JSON results there after creating parent directories. In an agent/skill context, this exceeds pure academic lookup behavior and can modify local files anywhere the process has permission, which can be abused for unintended filesystem writes or overwriting user data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation describes sending search queries concurrently to multiple third-party providers but does not clearly warn users that their search terms may be disclosed externally. In an academic research context, queries can reveal sensitive topics, unpublished work directions, or institutional interests, and concurrent multi-provider fan-out broadens that exposure.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Forcing locale and timezone to fixed values unrelated to user settings is unnecessary for basic arXiv result retrieval and contributes to synthetic browser fingerprinting. In combination with disguise tooling, this helps conceal the real execution environment and can support stealth automation beyond the stated academic-search use case.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The hidden/underdocumented download path performs a remote fetch and writes a PDF to disk without any user-facing warning at the point of use. In agent/tooling contexts, undisclosed side effects are dangerous because they can trigger unexpected persistence, consume storage/bandwidth, or be misused to pull attacker-selected content onto the local system.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The script performs network-backed retrieval and may auto-register a token, but it does not clearly disclose these external actions in normal output before doing so. Lack of transparency can mislead users about outbound connections, credential creation, or third-party service interaction, which is a security and privacy concern even if the behavior is expected by the SDK author.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: If no token is provided, the script silently invokes the SDK's auto-registration flow, which likely performs a network action and may create or obtain credentials without an explicit just-in-time user confirmation. In an agent skill context, implicit outbound registration can surprise operators, violate least surprise, and create unmanaged credentials tied to the runtime environment.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script can write arbitrary local files, but the risky side effect is only implicit in the optional --output flag and not accompanied by meaningful warning or guardrails. In security-sensitive agent environments, undisclosed write behavior increases the chance that users or orchestrators invoke the skill without understanding that it can alter the local filesystem.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The dispatcher sends raw user queries to external provider modules, which likely forward them to third-party services such as ArXiv, Semantic Scholar, Google Scholar, PubMed, or Wikipedia. In an academic research context, queries may contain sensitive project topics, unpublished ideas, or personal data, so undisclosed network transmission creates a real privacy and data-handling risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
arxiv>=2.0.0
beautifulsoup4>=4.12.3
semanticscholar
pypdf>=4.0.0
playwright>=1.40.0
deepxiv-sdk

• Confidence: 93% confidence
• Finding: The `semanticscholar` dependency is completely unpinned, so builds may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a skill that fetches and processes external academic content, supply-chain instability increases the risk of unexpected behavior or accidental adoption of a compromised package version.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

semanticscholar
pypdf>=4.0.0
playwright>=1.40.0
deepxiv-sdk

• Confidence: 94% confidence
• Finding: `deepxiv-sdk` is unpinned, which creates supply-chain risk because any future release could be pulled automatically during installation. This is somewhat more concerning for a research/search skill because SDKs often handle network requests and data parsing, so a malicious or vulnerable update could affect external-content ingestion paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
arxiv>=2.0.0
beautifulsoup4>=4.12.3
semanticscholar

• Confidence: 88% confidence
• Finding: `httpx>=0.27` is only minimally constrained, allowing any later version to be installed. That exposes the project to dependency confusion, unreviewed major-version changes, and the possibility of pulling in a vulnerable release during future installs or rebuilds.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
arxiv>=2.0.0
beautifulsoup4>=4.12.3
semanticscholar
pypdf>=4.0.0

• Confidence: 88% confidence
• Finding: `arxiv>=2.0.0` is not pinned to a specific version, so dependency resolution may drift over time and introduce vulnerable or incompatible releases. For a skill that depends on external scholarly sources, deterministic builds matter because parser/networking libraries directly affect the trust boundary.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
arxiv>=2.0.0
beautifulsoup4>=4.12.3
semanticscholar
pypdf>=4.0.0
playwright>=1.40.0

• Confidence: 89% confidence
• Finding: `beautifulsoup4>=4.12.3` permits newer unreviewed versions to be installed, making deployments non-reproducible and increasing supply-chain exposure. Because this skill likely parses remote HTML/pages, parser behavior changes can also create subtle security or reliability issues when handling untrusted content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

arxiv>=2.0.0
beautifulsoup4>=4.12.3
semanticscholar
pypdf>=4.0.0
playwright>=1.40.0
deepxiv-sdk

• Confidence: 97% confidence
• Finding: `pypdf>=4.0.0` is insufficiently pinned and also intersects with a known-vulnerable version called out separately. Since this skill may ingest arbitrary PDFs from external sources, loose versioning around a PDF parser increases the chance of deploying a version with denial-of-service or parsing flaws against attacker-controlled files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

beautifulsoup4>=4.12.3
semanticscholar
pypdf>=4.0.0
playwright>=1.40.0
deepxiv-sdk

• Confidence: 90% confidence
• Finding: `playwright>=1.40.0` is only loosely constrained, so future installs may silently pick up changed browser-automation behavior or vulnerable releases. Browser automation libraries operate on remote content and can expand attack surface, making deterministic version control especially important.

Known Vulnerable Dependency: pypdf==4.0.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The finding indicates use of `pypdf==4.0.0`, which has multiple advisories including possible infinite loops and long-runtime conditions when parsing malformed PDF structures. In this skill's context, PDF parsing is directly exposed to externally sourced academic papers, so a crafted PDF could trigger denial of service, hang processing, or exhaust resources.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.