ArXiv Scholar Search

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.0

Overview

This is a single-file arXiv search helper that only sends search queries to arXiv and formats returned paper metadata.

Reasonable to install for arXiv paper discovery. Do not include confidential project names, private identifiers, unpublished research details, or personal information in searches unless you are comfortable sending those terms to arXiv.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to send user-supplied search terms to the external arXiv API but does not disclose that those queries leave the local environment. This creates a real privacy and data-handling issue because users may include sensitive research topics, internal project names, or personal information in queries without informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.