SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsdym-scientific-agent-skills-tham-dinh-truoc-khi-cai

dym-scientific-agent-skills-tham-dinh-truoc-khi-cai

Security & auditing

View repository

Updated 10-18 01:22

About this skill

Skill: dym-scientific-agent-skills-tham-dinh-truoc-khi-cai — Vet a skill BEFORE installing

Why use it: Agent Skill is instructions that your agent will follow — it can tell the agent to run arbitrary code, install packages, call the network, modify files. This repo accepts community contributions and openly says it does not guarantee everything has been reviewed. This is a mandatory step before 01. What it produces: an install/no-install decision for each skill, based on the skill's content + the repo's scan report + (optionally) a local scan of your own.

Step 1 — Read SKILL.md without installing

# render SKILL.md trong terminal, không ghi file nào
gh skill preview K-Dense-AI/scientific-agent-skills literature-review

# ghim một version cụ thể để đọc
gh skill preview K-Dense-AI/scientific-agent-skills literature-review@v2.66.0

Run interactively, gh skill preview also provides a picker to browse more scripts/, references/. This is where you need to look closely: a bad skill is rarely bad in SKILL.md, it is bad in scripts/.

If you need to read with the shell (grep, diff), clone read-only and inspect:

git clone --depth 1 https://github.com/K-Dense-AI/scientific-agent-skills.git /tmp/sas
cd /tmp/sas

# skill này chạm mạng ở đâu, gọi shell ở đâu
grep -rnE 'requests\.|urlopen|subprocess|os\.system|curl |wget ' skills/literature-review/

# skill này đòi biến môi trường nào
grep -rn 'environ\|getenv\|API_KEY' skills/literature-review/

Step 2 — Check the repo's scan report

The repo runs Cisco AI Defense Skill Scanner weekly (cron Monday 09:00 UTC, .github/workflows/security-scan.yml), incremental scanning — unchanged skills carry over old results; a full rescan at least every 30 days or when the scanner/model changes.

  • Human-readable: docs/security-report.md
  • Machine-readable (with last_scanned per skill): docs/security-report.json

Total in scan 2026-08-31 (read from docs/security-report.json → totals):

163 skill · 988 finding · CRITICAL 34 · HIGH 9 · MEDIUM 241 · LOW 703 · INFO 1
skill "an toàn": 147/163

16 skills currently carrying a CRITICAL or HIGH finding — extracted from the field max_severity in the JSON, not from the summary table:

Level Skill Number of findings
CRITICAL autoskill 13
CRITICAL citation-management 11
CRITICAL consciousness-council 5
CRITICAL infographics 9
CRITICAL latex-posters 9
CRITICAL literature-review 10
CRITICAL pacsomatic 5
CRITICAL research-lookup 8
CRITICAL scientific-schematics 9
CRITICAL scientific-slides 15
CRITICAL xlsx 3
HIGH geomaster 7
HIGH ginkgo-cloud-lab 3
HIGH histolab 4
HIGH modal 7
HIGH waypoint-bio 5

Regenerate this table yourself on a newer version:

python3 - <<'PY'
import json
d = json.load(open("docs/security-report.json"))
for s in sorted(d["skills"], key=lambda s: s["name"]):
    if (s.get("max_severity") or "").upper() in ("CRITICAL", "HIGH"):
        print(f'{s["max_severity"]:8} {s["name"]:28} {len(s["findings"])} findings  last_scanned={s["last_scanned"]}')
print(d["totals"])
PY

A finding does not mean malicious. Main AGENTS.md itself lists the systematic false positives: BEHAVIOR_*_EXFILTRATION and BEHAVIOR_ENV_VAR_HARVESTING fire on any skill that reads its own API key of its own and then calls its own service of its own; MDBLOCK_PYTHON_SUBPROCESS fires on every subprocess, including the safe argument-list form; *_EVAL_EXEC fires on substrings in ordinary identifiers (retrieval, executor) or model.eval(). Use the table above to decide which skill to read carefully, not to convict.

Step 3 — Scan locally yourself (when you need your own evidence)

uv pip install cisco-ai-skill-scanner
skill-scanner scan /path/to/skill --use-behavioral

Or use the repo's wrapper — it adds PR comment formatting and a blocking threshold:

# cần SKILL_SCANNER_LLM_API_KEY (đọc từ .env qua python-dotenv)
uv run python scan_pr_skills.py skills/literature-review --fail-on HIGH

Exit code of scan_pr_skills.py — read from source, don't guess:

Exit Meaning Source
0 no valid skill dir → writes a no-op comment scan_pr_skills.py:229
0 missing SKILL_SCANNER_LLM_API_KEY → fail open, skip scanning (same as a PR from a fork) scan_pr_skills.py:240
1 has findings at level --fail-on or above scan_pr_skills.py:265
0 scan complete, below threshold scan_pr_skills.py:267

Two details that are easy to fall for:

  • By default --fail-on is CRITICAL, but the repo's CI passes --fail-on HIGH (.github/workflows/pr-skill-scan.yml:87). If you run it manually and want to match CI, you have to pass it yourself.
  • Missing API key returns 0, not an error. If you plug this command into your own gate, exit 0 does not prove a scan happened. Check stdout too, or ensure the environment variable exists.

--fail-on accepts: CRITICAL, HIGH, MEDIUM, LOW, NEVER.

Step 4 — Decide what to install

Principles drawn from the repo's own recommendations, ordered by order of application:

  1. Don't install --all. Install exactly the skill that serves the task at hand.
  2. Skills written by K-Dense (metadata.skill-author: K-Dense Inc.) have been through their internal review ; community skills are vetted at the level of "best effort, limited resources". Check the author: 
    grep -h 'skill-author' skills/*/SKILL.md | sort | uniq -c | sort -rn | head
  3. Skills with scripts/ deserve more scrutiny than skills with prose only. 105/163 skills carry scripts/.
  4. Skills that declare metadata.openclaw.envVars will demand credentials — 25 such skills, list in 03-dung-skill-trong-agent.md.
  5. If you see something suspicious, open an issue in the repo instead of silently removing it.

Pitfalls

  • docs/security-report.md is a snapshot at scan time, not the current state. Cross-check the skill's last_scanned against the date of the most recent commit touching that skill before trusting it.
  • Findings point to skill files that don't exist. AGENTS.md warns about this situation; verify with find skills/<name> -type f before "fixing".
  • Scanning skills is not scanning dependencies. The scanner inspects skill content; the Python packages a skill instructs you to install remain a separate attack surface.