Semantic Scholar Library Feed

• Outcome: Review
• Latest audit: May 28, 2026 · 10:03 AM UTC
• Version: 0.1.0

Overview

The skill is not deceptive, but it asks for reusable Semantic Scholar session cookies, stores them in plaintext, and can export or change private library data.

Install only if you are comfortable giving this skill reusable access to your Semantic Scholar session, private folders, and recommendations. Treat copied curl commands and saved cookie files like passwords, restrict their file permissions, avoid inline secrets in shell commands, review export paths and folder-add commands before running them, and delete the cookie store when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs storage of active Semantic Scholar session cookies in predictable plaintext files under the user's home directory without any warning, access-control guidance, or minimization. Session cookies such as sid and s2 can grant access to private Library and Feed data, so local disclosure, accidental inclusion in logs/backups, or reuse by another process could lead to account compromise or unauthorized data access.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells the user to export an authenticated browser request as curl and import it, but gives no warning that such a curl command may contain cookies, CSRF tokens, authorization headers, and other sensitive material. Those artifacts are easy to leak via shell history, temporary files, shared terminals, or later debugging output, enabling replay of an authenticated session against private endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly instructs users to copy an authenticated browser request and import raw cookies or Cookie headers into local files and CLI arguments. Those materials are effectively bearer credentials for the user's Semantic Scholar session, and storing or pasting them into agent-controlled workflows increases the chance of credential leakage through shell history, logs, temp files, or misuse by other scripts in the skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This workflow explicitly instructs authenticated access to a user's private Semantic Scholar Research Feeds and Library folder state, then recommends incremental persistence of retrieved data to local storage without any consent, minimization, retention, or privacy warning. In an agent setting, that creates a real risk of over-collection and silent storage of sensitive account-derived reading interests and folder associations, especially because the content is private and tied to an authenticated session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The CLI persists the full raw Cookie header to disk via bundle["cookieHeader"] = raw_header and save_cookie_bundle(...), which stores active authentication material that can be reused to access the user's Semantic Scholar account. In the context of a skill designed to work with private library/feed data, silently writing session cookies to disk materially increases the risk of credential theft from local compromise, logs, backups, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The ssr-dump command can write decoded SSR data from an authenticated private page directly to an arbitrary output file without warning. Because this data originates from a logged-in private page, it may contain private library metadata, recommendations, identifiers, and other account-specific information that users may unknowingly persist and later expose through filesystem access, sync, or source control.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The feed-crawl command continuously writes authenticated crawl state, including feed contents and pagination state, to disk when an output path is provided. Since the skill explicitly targets private Research Feeds and library-linked recommendations, these exports may reveal reading interests, saved-paper relationships, and other sensitive account-derived data without the user appreciating the privacy implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The folder-entries command exports contents of a private library folder to disk with no explicit disclosure that the output may contain sensitive reading lists, annotations, or research interests. In this skill's context, the data is inherently private and tied to a user's authenticated account, so silent export increases the chance of accidental leakage via shared machines, backups, or repositories.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The folder-add command performs a state-changing authenticated POST that modifies the user's library immediately unless --dry-run is specified. While this is the documented purpose of the command, the lack of confirmation or explicit safety interlock makes accidental or coerced modifications easier, particularly in agent/tooling contexts where commands may be composed or invoked automatically.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code persists a full Semantic Scholar cookie bundle and a raw Cookie header to disk in the user's home directory, which directly exposes reusable session credentials if the files are read by another local process, user, backup system, or log/telemetry mechanism. In this skill's context, those cookies grant access to private library folders and authenticated account actions, so plaintext storage materially increases the chance of account/session compromise.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions normalize reusing browser session cookies outside the browser and saving both structured cookies and a raw cookie header for later reuse. In the context of a skill that accesses private Library folders and Research Feeds, compromise of `sid` and `s2` can let the agent or any local process act as the user and read or modify private account data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.