sciatlas-literature-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask the user for the SciAtlas API token and to place that token into shell commands/environment-variable assignments (and to use it to verify/run search-papers), which requires handling and could lead to embedding the secret verbatim in generated commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow ingests outsider-authored free text from SciAtlas search-papers artifacts (e.g., report.md/response.json containing ranked papers and abstracts) which are not authored by the operating user, and this text is then read into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup instructions tell the runtime to install remote code via pip from the Git repo URL git+https://github.com/zjunlp/SciAtlas.git#subdirectory=sciatlas, which fetches and executes remote package code and is required for the skill to run.