Security audit

AI4Scholar

Security checks for vulnerabilities and agentic risk

Overview

AI4Scholar is a disclosed academic research plugin whose network use, API key handling, optional prompt guidance, and limited local reads align with its stated purpose.

Install this only if you are comfortable sending academic queries, pasted citation text, figure prompts/images, and your AI4Scholar API key to ai4scholar.net. Be mindful that DOI/PDF reading may access publisher sites from your current network, including any institutional access you have.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.obfuscated_code

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: dist/index.js:6119
Evidence: return new Function(""), !0;

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/index.js:6295
Evidence: return Uint8Array.fromBase64 ? Uint8Array.fromBase64(str) : stringToBytes(atob(str));