baidu-scholar-search

Academic Literature Search Tool enables the retrieval of both Chinese and English literature, covering various types of literature such as academic journals,...

Security Scan

The skill claims to be a Baidu Scholar/Search tool but its runtime instructions and script send queries to a third-party SkillBoss API (heybossai.com) and require a SKILLBOSS_API_KEY that is not declared in the registry metadata — the pieces are inconsistent and could leak search queries to an unexpected service.

Purpose & Capability

Name and homepage point to Baidu Xueshu, but the script and SKILL.md use the SkillBoss API Hub (https://api.heybossai.com/v1/pilot). The required API key (SKILLBOSS_API_KEY) and endpoint do not match the stated Baidu purpose, which is incoherent without an explicit explanation that SkillBoss proxies Baidu.

Instruction Scope

Runtime instructions direct the agent to POST user search queries to https://api.heybossai.com/v1/pilot with the SKILLBOSS_API_KEY. They do not access unrelated files or env vars, but they do transmit user-provided queries to an external third-party service not mentioned in the top-level metadata — potential data exfiltration risk for sensitive queries.

Install Mechanism

No install spec; this is instruction-only with a small included bash script that uses curl. Nothing is downloaded or written to disk beyond the included file, so install risk is low.

Credentials

SKILL.md requires SKILLBOSS_API_KEY, but the registry metadata provided with the skill lists no required environment variables or primary credential. Requesting an API key for an unrelated third-party service (SkillBoss) is disproportionate to the advertised Baidu search purpose unless clearly documented.

Persistence & Privilege

Skill is not always-included, is user-invocable, and does not request persistent or system-wide privileges. No evidence it modifies other skills or system configs.

What to consider before installing

This skill's name and homepage suggest it queries Baidu Xueshu, but both the documentation and the included script actually send your search terms to api.heybossai.com and require SKILLBOSS_API_KEY — a mismatch. Before installing or supplying an API key: 1) ask the publisher why SkillBoss is used instead of Baidu and request provenance/ownership info; 2) verify that you trust heybossai.com to receive your search queries (they may contain sensitive info); 3) confirm why registry metadata doesn't list the SKILLBOSS_API_KEY requirement; 4) if you must test, do so with non-sensitive queries and in an isolated environment, and use a revocable/test API key. If you need a true Baidu Xueshu integration, prefer a skill that directly documents and calls Baidu's official APIs or explicitly states it proxies through SkillBoss.

Academic Scholar Search

Based on the keywords entered by the user, search for both Chinese and English literature, covering various types of literature such as academic journals, conference papers, and dissertations

Setup

1. API Key: Ensure the SKILLBOSS_API_KEY environment variable is set with your valid SkillBoss API Hub key.
2. Environment: The API key should be available in the runtime environment.

API table

name	path	description
scholar_search	https://api.heybossai.com/v1/pilot	Based on the keywords entered, search for both Chinese and English literature via SkillBoss API Hub

Workflow

1. The script makes a POST request to the SkillBoss API Hub /v1/pilot endpoint with type: "search"
2. The API returns structured search results about a list of literature

Scholar Search API

Parameters

• wd: The search keywords (required, e.g. 'machine learning')
• pageNum: page num (default: 0)
• enable_abstract: whether to enable abstract (default: false)

Example Usage

curl -s -X POST 'https://api.heybossai.com/v1/pilot' \
-H 'Authorization: Bearer $SKILLBOSS_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"type": "search", "inputs": {"query": "人工智能"}, "prefer": "balanced"}'

EXEC scripts

#!/bin/bash

# Academic Scholar Search Skill Implementation
# Powered by SkillBoss API Hub

set -e

# Check if required environment variable is set
if [ -z "$SKILLBOSS_API_KEY" ]; then
    echo '{"error": "SKILLBOSS_API_KEY environment variable not set"}'
    exit 1
fi

WD="$1"
if [ -z "$WD" ]; then
    echo '{"error": "Missing wd parameter"}'
    exit 1
fi

pageNum="${2:-0}"
enable_abstract="${3:-false}"

curl -s -X POST \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"$WD\"}, \"prefer\": \"balanced\"}" \
  "https://api.heybossai.com/v1/pilot"
# Response path: .result.results