Academic Research Hub

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 9:58 PM UTC
• Version: 1.0.0

Overview

This appears to be a normal academic-search skill that searches public scholarly services and can save results or PDFs when the user asks it to.

Install this in a virtual environment, keep dependencies updated or pinned to patched versions, and run downloads/output commands only into a dedicated workspace folder. Expect your search terms to be sent to public academic services, and review downloaded PDFs and citation files before reusing or sharing them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The documented behavior allows arbitrary local file writes via --output and --output-dir without prominent constraints, while the description understates that capability and overstates other features such as Google Scholar and citation extraction from documents. This mismatch can mislead users or calling agents into invoking the skill in contexts they would not approve, increasing the risk of unintended file modification and unsafe automation decisions.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger guidance is broad enough to activate on many generic research-related prompts, which can cause the agent to invoke networked search and file-capable tooling when the user only wanted conceptual help. Over-broad invocation increases the chance of unnecessary external data transmission, unintended downloads, or unexpected file creation.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation promotes saving results and downloading papers but does not prominently warn that these actions create or overwrite local files. In an agent context, insufficient disclosure can lead to surprising filesystem side effects and accidental data placement in sensitive or unintended locations.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The README explicitly instructs users to download PDFs and write outputs to local paths, but it does not clearly warn that these commands will create directories and write files to the filesystem. In an agent-skill context, ambiguous documentation about local writes can lead to unintended file creation or downloads if a user or agent follows examples without realizing they modify disk state.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

semanticscholar>=0.8.0

# PubMed search (via BioPython)
biopython>=1.81

# HTTP requests
requests>=2.31.0

• Confidence: 84% confidence
• Finding: Although the requirement is written as biopython>=1.81, it allows installation of version 1.81, which the scanner identifies as vulnerable to XXE. In a research skill that may process external scholarly metadata or XML-derived content from PubMed-related workflows, this can expose the environment to XML external entity attacks if unsafe parsing paths are used.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

biopython>=1.81

# HTTP requests
requests>=2.31.0

# Optional: For enhanced parsing
beautifulsoup4>=4.12.0

• Confidence: 82% confidence
• Finding: The requests>=2.31.0 spec permits installation of 2.31.0, which is flagged with multiple advisories including credential leakage and verification issues. Because this skill is intended to fetch remote academic resources over HTTP(S), vulnerable client behavior can materially increase risk when interacting with attacker-controlled URLs or redirects.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Optional: For enhanced parsing
beautifulsoup4>=4.12.0
lxml>=4.9.0

• Confidence: 92% confidence
• Finding: The lxml>=4.9.0 requirement allows installation of 4.9.0, which is flagged for XXE and denial-of-service issues. In a skill that downloads and parses research documents or metadata, handling attacker-supplied XML/HTML with a vulnerable parser can lead to file disclosure, server-side request forgery, or parser crashes.

Known Vulnerable Dependency: biopython==1.81 — 2 advisory(ies): CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B); CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)

Medium

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: Biopython 1.81 is reported as vulnerable to XXE, which can allow attackers to make the parser access local files or internal network resources when processing crafted XML. Given this skill's academic-research context and likely interaction with external metadata feeds, the exposure is more meaningful than in a purely offline tool.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Requests 2.31.0 has multiple known advisories, including cases that can leak credentials or weaken request verification under certain conditions. This is particularly relevant because the skill is designed to retrieve content from external academic sites, where malicious links, redirects, or crafted URLs may be encountered during automated fetching.

Known Vulnerable Dependency: lxml==4.9.0 — 4 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2022-2309 (lxml NULL Pointer Dereference allows attackers to cause a denial of service); CVE-2022-2309 (NULL Pointer Dereference allows attackers to cause a denial of service (or appli) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: lxml 4.9.0 is associated with XXE and denial-of-service issues, making it dangerous when parsing untrusted XML or HTML from downloaded research sources. In this skill, attacker-controlled feeds, papers, or metadata could trigger parser abuse leading to data exposure, SSRF, or service instability.

Static analysis

No suspicious patterns detected.