paper-lookup

SAFE max severity MEDIUMSkillSpector Do not install 100 registry K-Dense-AI last scanned 2026-10-21 1 scan

Verdict safe, but 7 findings (4 medium, 3 low), mainly unauthorized tool use, data exfiltration, policy violation. Most recent scan 2026-10-21.

Findings7

Critical0

High0

Medium4

Low3

Analyzersstatic bytecode pipeline correlation behavioral trigger

Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100

Score100 / 100

Issues57

CategoriesData Exfiltration Supply Chain MCP Least Privilege

Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Searches 18 scholarly APIs for papers, preprints, citations, open-access full text, repository records, and journal OA status, and returns results with reproducible provenance. Covers PubMed, PMC, Europe PMC, bioRxiv, medRxiv, arXiv, OpenAlex, Crossref, Semantic Scholar, CORE, Unpaywall, OpenCitations, PubTator3, Zenodo, Figshare, ROR, BioStudies, and DOAJ. Use when searching for papers, citations, DOI/PMID/arXiv lookups, abstracts, full text, open-access PDFs, preprints, citation graphs, author publications, biomedical entity annotations, deposited records (Zenodo, Figshare, BioStudies),…

Package: 24 files, 177 KB
SKILL.md: 3798 words, 12+ sections
Code: Python (5)
Allowed tools: Read Bash
License: MIT
Compatibility: Needs network access and curl. The bundled scripts require Python 3.11+ and use only the standard library. No credentials are required; NCBI_API_KEY, S2_API_KEY, CORE_API_KEY, and OPENALEX_API_KEY raise rate limits or unlock full text where noted.

SKILL.md covers: Paper Lookup · Core Workflow · Database Selection Guide · By Use Case · Cross-Database Queries · Common Identifier Formats · API Keys and Access · Making API Calls · Request guidelines · Error recovery · Completeness and reproducibility · Bundled Scripts

Findings

MEDIUM Code makes network requests Unauthorized Tool Usestatic

Skill code makes network requests. While not controlled by allowed-tools, network access should be documented and justified in the skill description.

SKILL.md

Remediation: Document network usage in skill description or remove network operations if not needed

MEDIUM Skill declares no Write tool but bundled scripts write files Policy Violationstatic

Skill restricts tools to ['Read', 'Bash'] but bundled scripts appear to write to the filesystem, which conflicts with a read-only tool declaration.

SKILL.md

Remediation: Either add 'Write' to allowed-tools (if intentional) or remove filesystem writes from scripts

MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.Request(

scripts/paginate.py:76

request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT, **(headers or {})})

Remediation: Ensure network operations are necessary and document allowed destinations

MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.urlopen(

scripts/paginate.py:78

with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT) as response:

Remediation: Ensure network operations are necessary and document allowed destinations

LOW Code uses search/grep patterns but Grep tool not in allowed-tools Unauthorized Tool Usestatic

Skill restricts tools to ['Read', 'Bash'] but code uses regex search patterns

SKILL.md

Remediation: Add 'Grep' to allowed-tools or remove regex search operations

LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'a9.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/arxiv_atom.py:36

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.

LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'agentskills.io' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/paginate.py:46

What is in the package

24 files, 177 KB. Show the list.

File	Kind	Size
`SKILL.md`	doc	26 KB
`references/arxiv.md`	doc	12 KB
`references/biorxiv.md`	doc	6.7 KB
`references/biostudies.md`	doc	4.0 KB
`references/core.md`	doc	4.6 KB
`references/crossref.md`	doc	5.5 KB
`references/doaj.md`	doc	4.2 KB
`references/europepmc.md`	doc	9.0 KB
`references/figshare.md`	doc	3.1 KB
`references/medrxiv.md`	doc	5.0 KB
`references/openalex.md`	doc	5.5 KB
`references/opencitations.md`	doc	4.6 KB
`references/pmc.md`	doc	7.1 KB
`references/pubmed.md`	doc	4.5 KB
`references/pubtator.md`	doc	4.5 KB
`references/ror.md`	doc	4.2 KB
`references/semantic-scholar.md`	doc	7.1 KB
`references/unpaywall.md`	doc	3.5 KB
`references/zenodo.md`	doc	3.8 KB
`scripts/_common.py`	script	8.2 KB
`scripts/arxiv_atom.py`	script	8.0 KB
`scripts/jats_to_text.py`	script	11 KB
`scripts/openalex_abstract.py`	script	6.3 KB
`scripts/paginate.py`	script	19 KB

External hosts referenced

api.biorxiv.org export.arxiv.org arxiv.org www.ebi.ac.uk pmc.ncbi.nlm.nih.gov www.ncbi.nlm.nih.gov api.openalex.org api.semanticscholar.org eutils.ncbi.nlm.nih.gov help.openalex.org ror.org ror.readme.io doi.org openalex.org api.crossref.org api.opencitations.net doaj.org api.core.ac.uk core.ac.uk dash.harvard.edu api.ror.org api.unpaywall.org developers.zenodo.org docs.figshare.com europepmc.org info.arxiv.org unpaywall.org www.crossref.org www.semanticscholar.org ...pdf

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

S2_API_KEY CORE_API_KEY NCBI_API_KEY OPENALEX_API_KEY EXT_ID

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Bytecode analyzer.
Pipeline analyzer.
Correlation analyzer.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/K-Dense-AI/scientific-agent-skills
Raw scan result: skills-paper-lookup-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/k-dense-ai-paper-lookup.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

External hosts referenced

Environment variables referenced

What we checked

What we did not check

Sources

Related skills