ICUICU
critical

ai.smithery/IlyaGusev-academia_mcp

v1.14.0

Search arXiv and ACL Anthology, retrieve citations and references, and browse web sources to accel…

MCP RegistrysmitheryFirst seen Feb 24, 2026Source

29

Total

5

Critical

14

High

10

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    130: 
    131: # Environments
>>> 132: .env
    133: .venv
    134: env/
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    108: ### Settings Management (settings.py)
    109: 
>>> 110: Uses `pydantic-settings` to load configuration from `.env` file or environment variables:
    111: - API keys: OPENROUTER_API_KEY, TAVILY_API_KEY, EXA_API_KEY, BRAVE_API_KEY, OPENAI_API_KEY
    112: - Model names: REVIEW_MODEL_NAME, BITFLIP_MODEL_NAME, DOCUMENT_QA_MODEL_NAME, DESCRIBE_IMAGE_MODEL_NAME
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    281: ## Environment Variables for Testing
    282: 
>>> 283: When testing locally, create a `.env` file in the project root:
    284: ```
    285: OPENROUTER_API_KEY=your_key_here
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    150: - `PORT`: HTTP port (default `5056`).
    151: 
>>> 152: You can put these in a `.env` file in the project root.
    153: 
    154: ### Docker
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    37: 
    38:     model_config = SettingsConfigDict(
>>> 39:         env_file=".env",
    40:         env_file_encoding="utf-8",
    41:         env_prefix="",
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �KjױM驕�^E�)�{

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �KjױM驕�^E�)�{

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDE-009Data ExfiltrationMedium ConfidenceLine 0

PyPI config access (may contain tokens)

Detected by automated pattern matching (rule DE-009) with medium confidence. May be a false positive.

    170: 
    171: # PyPI configuration file
>>> 172: .pypirc
    173: 
    174: tokens.json
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �KjױM驕�^E�)�{

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: b��������r��� b

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��?��#y�iƝzh�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��i�b�{?�~Z0��r�'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��i�b�{?�~Z0��r�'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �����no�bq��{�%ɡ����iƝzh�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: b��������r��� b

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r��I��zT��h���e����n�ڶ����ho������l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r����ڵ� ��&jߊwij����塿�j�^����Z����ǚ��^��گ�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highSC-001Suspicious CommandsMedium ConfidenceLine 0

Subprocess execution

Detected by automated pattern matching (rule SC-001) with medium confidence. May be a false positive.

    120: 
    121:             try:
>>> 122:                 subprocess.run(
    123:                     [
    124:                         "latexmk",
Report false positive
highSC-001Suspicious CommandsMedium ConfidenceLine 0

Subprocess execution

Detected by automated pattern matching (rule SC-001) with medium confidence. May be a false positive.

    137:             except subprocess.TimeoutExpired:
    138:                 return f"Compilation timed out after {timeout} seconds"
>>> 139:             except subprocess.CalledProcessError as e:
    140:                 combined_output = (e.stdout or "") + "\n" + (e.stderr or "")
    141:                 log_path = temp_dir_path / "temp.log"
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    1: # Based on
>>> 2: # https://github.com/jonatasgrosman/findpapers/blob/master/findpapers/searchers/arxiv_searcher.py
    3: # https://info.arxiv.org/help/api/user-manual.html
    4: 
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    1: # Based on
>>> 2: # https://github.com/SamuelSchmidgall/AgentLaboratory/blob/main/tools.py
    3: # https://github.com/bytedance/pasa/blob/main/utils.py
    4: 
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    27:     api = YouTubeTranscriptApi(proxy_config=proxy_config)
    28:     try:
>>> 29:         transcript = api.fetch(video_id)
    30:     except Exception as e:
    31:         return f"Error fetching transcript for video {video_url}: {e}"
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 26, 2026critical29
Feb 24, 2026critical29