ClawHub
Back to skill

Security audit

AMiner Academic Search

Security checks for vulnerabilities and agentic risk

Overview

The skill’s academic search purpose is coherent, but its examples encourage putting an AMiner API token on the command line, which can expose the credential.

Review before installing or using. Prefer setting the token through `AMINER_TOKEN` or a secret store instead of typing it into commands, avoid submitting confidential or regulated research topics unless AMiner’s data handling is acceptable, and confirm the missing client implementation before relying on the workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:33
Finding

AMiner API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-51
Vulnerability Type: Insecure credential handling through command-line arguments
Risk Level: Medium

Vulnerable Code

bash
# Scholar profile analysis
python scripts/aminer_client.py --token <TOKEN> --action scholar_profile --name "Andrew Ng"

# Paper deep dive (with citation chain)
python scripts/aminer_client.py --token <TOKEN> --action paper_deep_dive --title "Attention is all you need"

# Organization analysis
python scripts/aminer_client.py --token <TOKEN> --action org_analysis --org "清华大学"

# Venue/journal paper monitoring
python scripts/aminer_client.py --token <TOKEN> --action venue_papers --venue "Nature" --year 2024

# Academic Q&A (natural language)
python scripts/aminer_client.py --token <TOKEN> --action paper_qa --query "transformer架构最新进展"

# Patent search
python scripts/aminer_client.py --token <TOKEN> --action patent_search --query "量子计算"

The same --token <TOKEN> pattern is repeated in the workflow examples at approximately lines 85, 102, 120, 137, 147, and 161.

Technical Analysis

The documentation instructs users to substitute an AMiner API token directly into a command-line argument. Secrets supplied this way can be exposed through:

  • Shell history files.
  • Process listings and process-monitoring utilities while the command is running.
  • Terminal session recording.
  • CI/CD command logs and diagnostic output.
  • Wrapper scripts, telemetry, or error reports that capture complete command lines.

This practice is unnecessary because the Skill metadata already declares the AMINER_TOKEN environment variable. The referenced scripts/aminer_client.py implementation is absent from the audited project, so its token redaction and handling behavior cannot be verified.

Attack Path

  1. A user follows one of the documented examples and replaces `<TOKEN&gt ...[truncated 1074 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every --token &lt;TOKEN&gt; example from SKILL.md.
  2. Make the client read the credential from the declared AMINER_TOKEN environment variable or from a supported operating-system secret store.
  3. For interactive use, permit token entry through a non-echoing prompt or protected standard input rather than a command-line option.
  4. If a --token option must remain for compatibility, clearly mark it as deprecated and reject or warn about its use in production and shared environments.
  5. Ensure authorization headers and tokens are redacted from application logs, exception messages, HTTP debugging output, telemetry, and retry diagnostics.
  6. Add the referenced scripts/aminer_client.py implementation to the package so its credential handling can be reviewed and tested.
  7. Add automated tests verifying that tokens never appear in logs, exceptions, or serialized workflow results.
  8. Advise users who previously followed these examples to remove affected shell-history entries and rotate potentially exposed AMiner tokens.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user-provided queries, names, institutions, patent terms, and other research inputs to AMiner's external APIs, but the documentation does not clearly warn users that their prompts and search terms leave the local environment. This creates a privacy and data-handling risk, especially if users submit sensitive research topics, unpublished work, or personal data under the assumption that the skill operates locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.