Scholar Search Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with academic paper search, but it asks users or agents to perform unpinned global third-party installs without clear containment or confirmation.

Review this before installing. The paper-search workflow itself is understandable, but install dependencies manually in an isolated environment, avoid the global `npx skills add ... -g -y` command unless you trust and verify that source, and choose where downloaded PDFs and generated research files should be stored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned and Unattended Installation of Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

--hash=sha256: rapidfuzz== --hash=sha256: ``` 7. Separate searching and scoring from dependency installation. The Skill should detect missing dependencies and ask for approval instead of automatically directing installation. 8. Document the expected publisher, source repository, package digest, and verification procedure. 9. Run PDF parsing and other third-party components in a sandbox with restricted filesystem and network access. 10. Periodically re-audit pinned dependencies and update them only through a controlled review process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明的核心功能是“搜索与下载论文，并生成摘要和 BibTeX”，而代码仅处理用户提供的标题/摘要或本地 CSV 文件，对论文进行关键词相关性评分。代码中没有网络访问、没有与 arXiv/会议源交互、没有下载文件逻辑、没有摘要生成或引用生成功能。因此这不是轻微实现细节差异，而是主要用途明显不一致。尽管声明中提到“筛选”与代码中的打分排序有一定相关，但这只覆盖了很小一部分，无法代表整体声明能力。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents all user-facing instructions, triggers, and usage guidance in Chinese, which effectively forces a specific language for interaction and setup. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified regional scope, neither of which appears here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install scholar-search-skills without pinning a specific version. That can cause users to execute whatever package version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly. In the context of an install command, this is a real security issue because it directly affects code execution on the user's machine.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill behavior and trigger conditions only in that language. Under the policy, language constraints should not be forced without user opt-in or an explicit documented justification, and this file does not offer an alternative language or note that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The duplicated finding refers to the same persistence behavior: creating durable directories and bibliographic/summary files in the user's home directory. While consistent with the skill's purpose, persistence still increases the risk of unintended retention and later disclosure of potentially sensitive research activity.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

步骤 2: 创建工作目录

bash

mkdir -p ~/papers/<研究主题>/{core-papers,cited-papers,output}

创建文献清单文件：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The duplicated finding refers to the same persistence behavior: creating durable directories and bibliographic/summary files in the user's home directory. While consistent with the skill's purpose, persistence still increases the risk of unintended retention and later disclosure of potentially sensitive research activity.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

步骤 2: 创建工作目录

bash

mkdir -p ~/papers/<研究主题>/{core-papers,cited-papers,output}

创建文献清单文件:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to run 'npx skills add existential-birds/beagle@docling -g -y', which fetches and installs remote code/tooling at execution time without a pinned immutable version. This creates a supply-chain risk: if the referenced package/tag changes or is compromised, the agent could install and execute attacker-controlled code with the agent's privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file contains natural-language descriptions, usage instructions, and help text only in Chinese. Under the policy, forcing a specific language without giving the user a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file states that the skill will batch-download PDFs and generate structured summaries, and later lists multiple output files and directories it creates. Under the markdown criteria for SQP-2, user-facing documentation should warn when behavior may affect user data or system state, but no caution or notice is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file presents the skill/documentation exclusively in Chinese, including headings and usage guidance, with no indication that users can choose another language. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.