Skills semantic-scholar-library-feed

📦

semantic-scholar-library-feed

Name: semantic-scholar-library-feed
Author: zjsxply

Content revision r1 Critical ⚙️ External commands📁 Filesystem access⚡ Contains scripts🌐 Network access

Manage Semantic Scholar Research Feeds

Researchers need repeatable access to Semantic Scholar feeds and private library folders. This skill provides CLI workflows for authenticated feed export, folder inspection, and paper resolution.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "semantic-scholar-library-feed" from https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed.md and its manifest at https://skillstore.io/api/skills/zjsxply-semantic-scholar-library-feed/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/zjsxply-semantic-scholar-library-feed.md Signed manifest GET /api/skills/zjsxply-semantic-scholar-library-feed/manifest Signed lockfile GET /api/skills/zjsxply-semantic-scholar-library-feed/lockfile

Test it

Using "semantic-scholar-library-feed". Check whether my cookie store is usable.

Expected outcome:

Reports whether the cookie file exists.
Lists missing required cookie names without printing full cookie values.
Recommends importing a fresh browser curl when required cookies are absent.

Using "semantic-scholar-library-feed". Export my feed for local screening.

Expected outcome:

Creates a saved feed crawl with window counts and paper counts.
Records the stop reason, such as no next window or duplicate window.
Preserves recommendation metadata for later local review.

Using "semantic-scholar-library-feed". Resolve these arXiv identifiers before adding them to a folder.

Expected outcome:

Returns matching Semantic Scholar paper records for the supplied identifiers.
Deduplicates repeated identifiers before the batch lookup.
Can save the resolved records for review before any folder update.

Security Audit

Critical

v6 • 7/8/2026 Open versioned report

Most command-execution and reconnaissance alerts are false positives from Markdown backticks, help strings, or documented endpoint notes. The real risks are handling reusable Semantic Scholar session cookies, writing private data to local files, outbound authenticated requests, and an unvalidated page URL that can leak cookies. No prompt-injection text was found in the reviewed skill files.

Files scanned

1,423

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

scripts/semantic_scholar_cli.py:279-283 scripts/semantic_scholar_cli.py:333-334 scripts/ss_store.py:213-230

Unvalidated URL Can Receive Session Cookies

The CLI accepts a page URL for SSR and feed bootstrapping, then fetches it with the stored Cookie header. A malicious or mistaken URL can receive reusable Semantic Scholar session cookies.

The code attaches Cookie headers whenever a bundle is present, while ssr-dump and feed-crawl accept page URLs without origin validation. This is a direct credential disclosure path.

High

SKILL.md:39-44 references/auth-and-cookies.md:25-39 scripts/ss_store.py:169-179

Plaintext Semantic Scholar Session Cookie Storage

The workflow imports browser session cookies and writes both structured cookies and a raw Cookie header to local files. These files can be reused to access private Library and Research Feed data.

The documentation explicitly requires sid and s2 cookies, and the implementation writes the raw header to disk. The behavior is intentional but exposes high-value account credentials if file access is weak.

High

SKILL.md:84-91 references/library.md:28-43 scripts/semantic_scholar_cli.py:478-501

Authenticated Library Mutation Without Built-In Confirmation

The skill includes a folder-add command that posts to Semantic Scholar's bulk library endpoint. Without a required confirmation step, an agent can modify the user's private library once cookies are available.

The documented workflow and implementation perform an authenticated POST that changes folder membership. A dry-run flag exists, but confirmation is not enforced by the command.

Capability review items (22)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/auth-and-cookies.md:7

Hidden file in home directory

- `~/.auth/semantic-scholar.cookies.json`

The skill directs storage or access of raw Semantic Scholar session cookies under hidden home-directory paths. Those files contain reusable account credentials and no permission or encryption control is shown.

High

references/auth-and-cookies.md:8

Hidden file in home directory

- `~/.auth/semantic-scholar.cookie-header.txt`

High

SKILL.md:41

Hidden file in home directory

- `~/.auth/semantic-scholar.cookies.json`

High

SKILL.md:42

Hidden file in home directory

- `~/.auth/semantic-scholar.cookie-header.txt`

Medium

references/auth-and-cookies.md:7

Hidden file access

- `~/.auth/semantic-scholar.cookies.json`

Medium

references/auth-and-cookies.md:8

Hidden file access

- `~/.auth/semantic-scholar.cookie-header.txt`

Medium

references/auth-and-cookies.md:14

Temp directory access

- `/tmp/custom.cookies.json`

The example path is under /tmp and is used for cookie material or browser-copied curl data. Shared temporary locations can expose reusable Semantic Scholar session credentials.

Medium

references/auth-and-cookies.md:15

Temp directory access

- `/tmp/custom.cookie-header.txt`

The example path is under /tmp and is used for cookie material or browser-copied curl data. Shared temporary locations can expose reusable Semantic Scholar session credentials.

Medium

references/auth-and-cookies.md:31

Temp directory access

--curl-file /tmp/semantic-scholar-request.sh

The example path is under /tmp and is used for cookie material or browser-copied curl data. Shared temporary locations can expose reusable Semantic Scholar session credentials.

Medium

references/library.md:89

Temp directory access

--output /tmp/folder-13895811.json

The example writes private Semantic Scholar feed or folder data under /tmp. This is user-authorized output, but shared temporary storage can disclose private research activity.

Medium

references/research-feed.md:93

Temp directory access

--output /tmp/research-feed.json

The example writes private Semantic Scholar feed or folder data under /tmp. This is user-authorized output, but shared temporary storage can disclose private research activity.

Medium

scripts/ss_store.py:236

HTTP client library

def request(

The code performs outbound HTTP requests and attaches authenticated Semantic Scholar cookies for private endpoints. Network access is core functionality, but it creates privacy and credential-handling risk.

Medium

scripts/ss_store.py:284

HTTP client library

response = request(

Medium

scripts/ss_store.py:302

HTTP client library

response = request(

Medium

SKILL.md:41

Hidden file access

- `~/.auth/semantic-scholar.cookies.json`

Medium

SKILL.md:42

Hidden file access

- `~/.auth/semantic-scholar.cookie-header.txt`

Medium

SKILL.md:24

Temp directory access

--curl-file /tmp/semantic-scholar-request.sh

The example path is under /tmp and is used for cookie material or browser-copied curl data. Shared temporary locations can expose reusable Semantic Scholar session credentials.

Medium

SKILL.md:64

Temp directory access

--output /tmp/research-feed.json

The example writes private Semantic Scholar feed or folder data under /tmp. This is user-authorized output, but shared temporary storage can disclose private research activity.

Medium

SKILL.md:81

Temp directory access

--output /tmp/folder.json

The example writes private Semantic Scholar feed or folder data under /tmp. This is user-authorized output, but shared temporary storage can disclose private research activity.

Low

scripts/ss_store.py:13

Python HTTP libraries

from urllib.request import Request, urlopen

Low

scripts/ss_store.py:15

Hardcoded URL

SEMANTIC_SCHOLAR_ORIGIN = "https://www.semanticscholar.org"

Low

scripts/ss_store.py:16

Hardcoded URL

GRAPH_API_ORIGIN = "https://api.semanticscholar.org"

Risk Factors

⚙️ External commands (32)

📁 Filesystem access (16)

references/auth-and-cookies.md:7 references/auth-and-cookies.md:8 references/auth-and-cookies.md:7 references/auth-and-cookies.md:8 references/auth-and-cookies.md:14 references/auth-and-cookies.md:15 references/auth-and-cookies.md:31 references/library.md:89 references/research-feed.md:93 SKILL.md:41 SKILL.md:42 SKILL.md:41 SKILL.md:42 SKILL.md:24 SKILL.md:64 SKILL.md:81

⚡ Contains scripts (1)

scripts/semantic_scholar_cli.py:11-30

🌐 Network access (7)

scripts/ss_store.py:236 scripts/ss_store.py:284 scripts/ss_store.py:302 scripts/ss_store.py:13 scripts/ss_store.py:15 scripts/ss_store.py:16 scripts/ss_store.py:22

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zjsxply-semantic-scholar-library-feed/security.svg)](https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zjsxply-semantic-scholar-library-feed/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/zjsxply-semantic-scholar-library-feed.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

zjsxply. (2026). semantic-scholar-library-feed security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed/audits/6

BibTeX citation

@techreport{zjsxply-zjsxply-semantic-scholar-library-feed-2026,
  author = {zjsxply},
  title = {semantic-scholar-library-feed security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "semantic-scholar-library-feed security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "zjsxply"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/zjsxply-semantic-scholar-library-feed/audits/6"
identifiers:
  - type: other
    value: "skillstore:zjsxply-semantic-scholar-library-feed:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Export a Research Feed

Collect recommendation windows for later review, filtering, or archiving.

Audit a Library Folder

List folder entries, compare them with a bibliography, and identify missing papers.

Resolve Paper Identifiers

Convert arXiv or DOI identifiers into Semantic Scholar paper records before folder updates.

Try These Prompts

Check Cookie Readiness

Check whether my Semantic Scholar cookie store is ready. Tell me which cookies are missing and what I should refresh.

Export Feed History

Crawl my Semantic Scholar Research Feed and save each window as progress is made. Stop when pagination is complete.

Compare Folder to Bibliography

Export my target Semantic Scholar folder, resolve identifiers from my bibliography, and report which papers are missing.

Prepare Safe Folder Updates

Resolve these paper identifiers, show the proposed folder additions first, and only add papers after I approve the final list.

Best Practices

Use a private, user-controlled directory for cookies and exported private data.
Review proposed folder additions before running any command that changes the library.
Refresh cookies from a successful Semantic Scholar browser request when private endpoints return 401.

Avoid

Do not paste authenticated curl commands into shared terminals or logs.
Do not store Semantic Scholar session cookies in shared temporary directories.
Do not run folder-add until the target folder and paper list are confirmed.

Frequently Asked Questions

Does this skill need my Semantic Scholar password?

No. It uses cookies copied from an already authenticated browser session.

Can it read private Library folders?

Yes, when valid session cookies are available and the account has access to those folders.

Can it change my Semantic Scholar account?

Yes. The folder-add workflow can add papers to Library folders.

Does it use official Semantic Scholar APIs only?

No. It uses the public Graph API and private web endpoints observed from Semantic Scholar pages.

Will it hide my cookie values in every output?

The cookie summary masks cookie headers, but imported curl files and cookie stores remain sensitive.

Can Claude, Codex, and Claude Code use this skill?

Yes. The report lists support for Claude, Codex, and Claude Code.

Developer Details

Author

zjsxply

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/zjsxply/skills/tree/main/semantic-scholar-library-feed/

Ref

88a205c7f635a966e31156313b590d59007c5caa

Maintenance freshness

7/18/2026

Usage

34 downloads · 184 views

File structure

📁 references/

📄 auth-and-cookies.md

📄 library.md

📄 research-feed.md

📁 scripts/

📄 semantic_scholar_cli.py

📄 ss_store.py

Analyze One Scientific Paper as an Evidence Card

by yuan1z0825

Scientific papers are difficult to evaluate when claims, methods, and evidence are scattered across sections. This skill creates a structured, traceable Paper Card with explicit limits.

Research & Learning View

semantic-scholar-library-feed

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Export a Research Feed

Audit a Library Folder

Resolve Paper Identifiers

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from zjsxply

image-to-text-pdf

awesome-repo-builder

url-citation-search

skill-market-publisher

Related Skills

research-lookup

nature-downloader

venue-templates

nature-figure

diffdock

nature-paper-card