Security audit

Academic Research Hub

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an academic search/download tool, but its installation and PDF-download handling need review before use.

Review this skill before installing. Use an isolated virtual environment, avoid elevated installs, consider pinning only the actually required packages, and be cautious with --download because remote content is saved locally without strong validation or size limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:4
Finding: Unnecessary and Unpinned Third-Party Dependencies Expand the Supply-Chain Attack Surface
Content: View full analysis
=2.0.0 # Semantic Scholar search semanticscholar>=0.8.0 # PubMed search (via BioPython) biopython>=1.81 # HTTP requests requests>=2.31.0 # Optional: For enhanced parsing beautifulsoup4>=4.12.0 lxml>=4.9.0 ``` ### Technical Analysis The installation instructions require OpenClawCLI even though `scripts/research.py` does not import, invoke, or otherwise depend on that program. The documentation also instructs users to install `scholarly` and `pubmed-parser`, neither of which is used by the implementation. The actual PubMed integration imports BioPython's `Bio.Entrez`. The dependencies in `requirements.txt` use open-ended minimum-version constraints. Consequently, a future installation may retrieve package versions that were never reviewed with this skill. No lock file or cryptographic hashes are provided to ensure that users install the same dependency artifacts that were audited. Every package installation can execute package-controlled build or installation behavior. Requiring unused packages therefore increases supply-chain exposure without supporting the declared functionality. The audit found no evidence that the currently named packages are malicious; the risk arises ...[truncated 1354 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/research.py:165
Finding: Remote PDF Downloads Lack Destination, Redirect, Type, and Size Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents commands that perform network access to third-party academic services and write results/PDFs to the local filesystem, but the manifest declares no explicit tool scope such as allowed-tools or permissions. This creates a mismatch between user expectations, policy enforcement, and actual capability, increasing the risk of unintended downloads, data egress, or local file modification when the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest trigger description is very broad and can cause the skill to activate for a wide range of generic research-related requests. Because this skill can download files and save outputs, overbroad routing increases the chance that it is invoked in situations where the user did not intend network retrieval or filesystem writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description emphasizes search and retrieval but does not prominently warn that it may download PDFs and write search results, citations, or bibliographies to local files. This weakens informed consent and can lead to unexpected local state changes or storage of untrusted remote content on the user's machine.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 746)May include surrounding context.
md
- OpenClawCLI: https://clawhub.ai/ - arXiv API: https://arxiv.org/help/api - PubMed API: https://www.ncbi.nlm.nih.gov/books/NBK25501/ - Semantic Scholar API: https://api.semanticscholar.org/

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file describes PDF downloads, organized file naming, output files, and output directories, but it does not explicitly warn users that running these commands will create local files and potentially download multiple PDFs. Under the markdown criteria for SQP-2, behaviors affecting user data or system state should be disclosed clearly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README credits the scholarly package as a Google Scholar scraper, implying Google Scholar capability is part of the skill, while the limitations section states 'Google Scholar not included (no API)'. This is an active documentation contradiction about the skill's intended sources and supported functionality.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency is specified with a minimum version only, which allows future unresolved versions to be installed. This weakens build reproducibility and can accidentally introduce vulnerable or breaking releases through the supply chain, though the file itself does not prove an actively exploitable condition.
Content: Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.
text
# Academic Research Hub - Python Dependencies # arXiv search arxiv>=2.0.0 # Semantic Scholar search semanticscholar>=0.8.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: Using an unpinned version for this package means installations may resolve to different releases over time. That increases supply-chain risk and makes it harder to verify whether deployed environments are using safe, tested versions.
Content: Scanner excerpt · scripts/requirements.txt (reported line 7)May include surrounding context.
text
arxiv>=2.0.0 # Semantic Scholar search semanticscholar>=0.8.0 # PubMed search (via BioPython) biopython>=1.81

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: An unpinned Biopython dependency is more concerning because known advisories exist in some releases, yet this manifest does not indicate which version will actually be installed. That creates uncertainty about exposure and allows vulnerable versions to be pulled into different environments.
Content: Scanner excerpt · scripts/requirements.txt (reported line 10)May include surrounding context.
text
semanticscholar>=0.8.0 # PubMed search (via BioPython) biopython>=1.81 # HTTP requests requests>=2.31.0

Unverifiable Dependency: biopython has 2 known advisory(ies) (CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B); CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Biopython has known advisories involving XXE-style XML parsing issues, and because the manifest does not pin a version there is no way to verify whether affected releases may be installed. In a skill that searches and downloads scholarly content, processing untrusted remote metadata or documents can make parser flaws more relevant.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Requests is network-facing and has a substantial advisory history, so leaving it unpinned increases the chance of resolving to a version with known security issues or behavioral changes. In a research skill that likely fetches remote content, this dependency has more security relevance than a purely local utility.
Content: Scanner excerpt · scripts/requirements.txt (reported line 13)May include surrounding context.
text
biopython>=1.81 # HTTP requests requests>=2.31.0 # Optional: For enhanced parsing beautifulsoup4>=4.12.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Requests has numerous published advisories, and the absence of a pinned version means the security posture of deployed environments cannot be verified. Because this skill likely makes outbound requests to academic sources, using an unknown requests release increases exposure to credential leakage or request-handling flaws present in some versions.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: An unpinned BeautifulSoup dependency reduces reproducibility and can expose deployments to future vulnerable releases or incompatible parser behavior. By itself this is a low-severity supply-chain hygiene issue rather than direct evidence of exploitation.
Content: Scanner excerpt · scripts/requirements.txt (reported line 16)May include surrounding context.
text
requests>=2.31.0 # Optional: For enhanced parsing beautifulsoup4>=4.12.0 lxml>=4.9.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Leaving lxml unpinned is riskier because lxml has a history of parser-related security issues and this skill appears to process downloaded remote documents. An unresolved version can lead to inconsistent installs and accidental inclusion of vulnerable parser builds.
Content: Scanner excerpt · scripts/requirements.txt (reported line 17)May include surrounding context.
text
# Optional: For enhanced parsing beautifulsoup4>=4.12.0 lxml>=4.9.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Lxml has multiple historical advisories, including parser and sanitizer-related issues, and the unpinned dependency prevents verification that a safe release will be installed. Since the skill may download and parse remote HTML/XML research content, an unsafe lxml version could increase the risk from maliciously crafted documents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.