Daily Literature Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its literature-monitoring purpose, but its installer makes persistent cron changes by default and contains unsafe shell execution patterns users should review before installing.

Review install.sh before running it. Prefer manual execution or dry-run first, add cron only after you explicitly decide you want unattended daily runs, avoid sourcing .env as shell code, store real API/email/webhook secrets carefully, and verify the referenced literature-review skill path is trusted.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: install.sh:148

Finding

Installer Automatically Establishes User-Level Cron Persistence

Content

View full analysis

/dev/null; then log_warning "crontab not available. Skipping cron setup." log_info "You can manually add the following line to your crontab:" echo " ${CRON_TIME} * * * python3 ${SCRIPT_DIR}/scripts/daily_literature_search.py >> ${SCRIPT_DIR}/logs/cron.log 2>&1" return fi # Create cron entry CRON_ENTRY="${CRON_TIME} * * * python3 ${SCRIPT_DIR}/scripts/daily_literature_search.py >> ${SCRIPT_DIR}/logs/cron.log 2>&1" if [ "$UNINSTALL" = true ]; then # Remove existing cron entry (crontab -l 2>/dev/null | grep -v "daily_literature_search.py") | crontab - log_success "Cron job removed." else # Add cron entry (avoid duplicates) TEMP_CRON=$(mktemp) crontab -l 2>/dev/null | grep -v "daily_literature_search.py" > "$TEMP_CRON" || true echo "$CRON_ENTRY" >> "$TEMP_CRON" run_or_dry "crontab $TEMP_CRON" rm -f "$TEMP_CRON" log_success "Cron job installed: Daily search at ${CRON_TIME// /:}" fi } ``` The behavior is also disclosed in `README.md:42-49` and `SKILL.md:101-108`. ### Technical Analysis The default installation process modifies the current user's crontab and schedules the project script to execute every day. This behavior persists across terminal sessions, user logins, and individual skill invocations. Daily scheduling is related to the declared literature-monitoring functionality and is documented rather than concealed. Nevertheless, persistent execution is not necessary for installation or manual operation. Installing it automatically, without a dedicated opt-in flag or confirmation prompt, exceeds the minimum privileges ...[truncated 1405 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:62

Finding

Arbitrary Shell Command Execution Through eval and Unvalidated Configuration Paths

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Mutable and Globally Installed Python Dependencies Create Supply-Chain Exposure

Content

View full analysis

=2.28.0 # YAML configuration support pyyaml>=6.0 ``` The installer installs these packages through the active `pip3` executable: ```bash # Install Python dependencies install_dependencies() { log_info "Installing Python dependencies..." if [ -f "${SCRIPT_DIR}/requirements.txt" ]; then run_or_dry "pip3 install -r ${SCRIPT_DIR}/requirements.txt" log_success "Dependencies installed." else log_warning "requirements.txt not found. Skipping dependency installation." fi } ``` ### Technical Analysis The `>=` constraints allow any future release satisfying the minimum version. The project therefore does not define a reproducible, reviewed dependency set. It also does not require package hashes or explicitly constrain the package index. The package names `requests` and `pyyaml` are established packages, and the reviewed source contains no evidence that they are intentionally malicious or typographically spoofed. The risk arises from mutable dependency resolution: a compromised future release, compromised configured index, malicious mirror, or altered name-resolution environment could cause the installer to retrieve code that was not included in the audit. Using the active `pip3` without first creating an isolated virtual environment can modify the user's global or otherwise shared Python environment. This may affect unrelated applications and makes it harder to determine which dependency versions are actually used by the scheduled task. ### Attack Path 1. The user ...[truncated 1084 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (38)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

Edit config.yaml with your keywords and settings

Set environment variables

cp .env.example .env

Edit .env with your email and API keys

source .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

Set environment variables

cp .env.example .env

Edit .env with your email and API keys

source .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 186)May include surrounding context.

sh

# Set environment variables
cp .env.example .env
# Edit .env with your email and API keys
source .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 265)May include surrounding context.

sh

# Set environment variables
cp .env.example .env
# Edit .env with your email and API keys
source .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The README tells users to 'source .env', which executes the file as shell code rather than merely loading key-value pairs safely. If the .env file is altered maliciously or contains shell metacharacters/commands, sourcing it can execute arbitrary commands in the user's shell session.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

Set environment variables

cp .env.example .env

Edit .env with your email and API keys

source .env

text

### 2. Test Run

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second independent mismatch finding indicates the skill is represented as a scheduled multi-source literature automation system while the observed behavior is limited and materially different. When a skill's stated purpose diverges from real behavior, it can bypass human review, cause unsafe deployment decisions, and mask collection or file-processing actions that users did not intend to authorize.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A second independent mismatch finding indicates the skill is represented as a scheduled multi-source literature automation system while the observed behavior is limited and materially different. When a skill's stated purpose diverges from real behavior, it can bypass human review, cause unsafe deployment decisions, and mask collection or file-processing actions that users did not intend to authorize.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 181)May include surrounding context.

sh

setup_env() {
    log_info "Setting up environment variables..."
    
    ENV_FILE="${SCRIPT_DIR}/.env"
    
    if [ ! -f "$ENV_FILE" ]; then
        cat > "$ENV_FILE" << EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 265)May include surrounding context.

sh

setup_env() {
    log_info "Setting up environment variables..."
    
    ENV_FILE="${SCRIPT_DIR}/.env"
    
    if [ ! -f "$ENV_FILE" ]; then
        cat > "$ENV_FILE" << EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 217)May include surrounding context.

sh

# Optionally remove data (commented out for safety)
    # log_warning "Removing data directories..."
    # run_or_dry "rm -rf ${PAPERS_DIR}/daily_search_logs"
    
    log_success "Uninstallation completed."
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states that the installer automatically sets up a cron job for daily execution, and the skill also downloads papers and writes logs/files, but it does not prominently warn users about these persistent system changes and local file writes. Hidden persistence and unattended network/file activity increase operational risk, especially for users running install scripts without reviewing them.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

bash

# Verify cron job
crontab -l | grep daily_literature

# Or manually add:
# 30 6 * * * python3 /path/to/scripts/daily_literature_search.py

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 164)May include surrounding context.

sh

```bash
# Verify cron job
crontab -l | grep daily_literature

# Or manually add:
# 30 6 * * * python3 /path/to/scripts/daily_literature_search.py

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 169)May include surrounding context.

sh

```bash
# Verify cron job
crontab -l | grep daily_literature

# Or manually add:
# 30 6 * * * python3 /path/to/scripts/daily_literature_search.py

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Privacy section says 'All data stored locally' while the same README documents optional external notifications via email/webhooks. This can mislead users into believing no data leaves the host, causing unintentional disclosure of search terms, paper metadata, or report contents to third-party services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes behavior that requires sensitive capabilities including environment-variable access, filesystem reads/writes, network access, and shell execution, but it declares no explicit tool scope or permission boundaries. In agent environments, this can cause the skill to run with broader ambient privileges than users expect, increasing the blast radius if the skill is misused or if its implementation later changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The sample daily report is entirely in Chinese, which indicates the skill may generate user-facing output in a fixed language. The file does not state that Chinese output is optional, configurable, or required for a specific regional use case, so this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 87)May include surrounding context.

sh

fi
    
    # Check cron
    if ! command -v crontab &> /dev/null; then
        log_warning "crontab not found. Scheduled searches won't work automatically."
    fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 152)May include surrounding context.

sh

fi
    
    # Check cron
    if ! command -v crontab &> /dev/null; then
        log_warning "crontab not found. Scheduled searches won't work automatically."
    fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script creates a plaintext .env file containing placeholders for API keys, webhook URLs, and email credentials, but it does not warn users about local secret storage risks or set restrictive permissions. In an academic automation context, users are likely to populate real credentials, which could then be exposed via weak filesystem permissions, backups, or accidental commits.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a scheduled search pipeline over PubMed, OpenAlex, and Semantic Scholar with deduplication, open-access download, and daily reports. This file instead scans a fixed local upload directory, classifies PDFs by filename heuristics, copies them into topic folders, and writes a local report, which is a materially different workflow than the described search system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language descriptions and user-facing messages exclusively in Chinese, indicating a fixed language/locale experience. The file does not offer any language selection, opt-in, or documented region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill extends its execution boundary by launching a separate sibling skill from a filesystem path derived from configuration. In a skill ecosystem, that creates a code-execution trust chain: if the sibling skill or its parent directory is tampered with, running this literature search also executes attacker-controlled code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Many user-visible strings, including operational logs and generated report content, are hard-coded in Chinese, which forces a specific language experience. The file does not provide a language selection mechanism or explain that the skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_literature_search.py (reported line 205)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,