deep-research

SUSPICIOUS: the skill is broadly coherent with a deep-research purpose and routes AMiner credentials to the expected AMiner API, but it has a meaningful indirect-prompt-injection surface and notable install-trust uncertainty because the skill appears to come from a personal GitHub repo rather than a clearly official AMiner publisher. No confirmed credential theft, covert behavior, or malicious exfiltration is evident in the provided content.

The code is intended as a figure renderer, but its optional script mode constitutes arbitrary Python code execution when an attacker can influence the ledger's code_path or the referenced script. The token blacklist is an insufficient security boundary, and the subprocess is not sandboxed. The built-in template path is comparatively low risk for ordinary data, but untrusted script mode should be disabled or replaced with a real sandbox and strict path validation. The shown fragment also has a syntax error that prevents execution as written.