Security audit

Arxiv Paper Writer

Security checks for vulnerabilities and agentic risk

Overview

This paper-writing skill is mostly aligned with its stated purpose, but it needs review because its setup guidance can make persistent administrator-level LaTeX environment changes without clear safeguards.

Install only if you are comfortable with a skill that can create and modify paper project files and may guide LaTeX/Python environment setup. Do not run the administrator-wide MiKTeX auto-install or `sudo apt install` commands unless you intentionally want to change the machine, and prefer a per-user or isolated TeX environment with reviewed dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/agent_survey_practice.md:69
Finding: Unpinned Third-Party Python Dependencies
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/latex_environment.md:14
Finding: Administrator-Wide Automatic MiKTeX Package Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad paper-authoring skill for creating and managing full arXiv-style academic manuscripts. In contrast, the code chunk only performs a limited validation task on a BibTeX file. While BibTeX checking is related to academic paper tooling, it is only a small supporting utility and does not match the skill’s stated primary purpose or breadth of capabilities. Therefore this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes an end-user paper-authoring skill focused on generating and working with arXiv-style academic manuscripts. The actual code chunk does not implement paper writing, LaTeX compilation, debugging, review, or manuscript generation. Instead, it performs internal validation of the skill's file layout and metadata by checking for required files and frontmatter in SKILL.md. That is a materially different primary purpose from the declared description, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SUBMODULE_NOTES.md (reported line 30)May include surrounding context.
Example commands after the independent repository exists:

bash
git rm -r skills/arxiv-paper-writer git submodule add <REMOTE_URL> skills/arxiv-paper-writer git commit -m "将 arxiv-paper-writer skill 接入为独立 submodule"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Forcing progress summaries in Chinese without user opt-in can cause confusion, concealment, or reduced user oversight, especially when the user expects auditability in another language. In an agent workflow, unexpected language switching can make it harder for the user to detect mistakes, policy violations, or unauthorized actions being described in status updates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All user-facing prompts in this file are written in Chinese, while the expected outputs do not indicate that language selection is optional or user-configurable. This can reflect a natural-language policy issue if the skill implicitly assumes a single language without documenting choice or justification.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/agent_survey_practice.md (reported line 63)May include surrounding context.
pdflatex main.tex

text
Read `main.log` after failures. Do not guess LaTeX fixes without checking the exact error. ## Optional Python / uv setup

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/latex_environment.md (reported line 35)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/latex_environment.md (reported line 36)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 43)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 44)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 50)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 51)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 66)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/linux_texlive_full.md (reported line 152)May include surrounding context.
Recommended Ubuntu/Debian minimal install:

bash
sudo apt update sudo apt install -y \ texlive-latex-base \ texlive-latex-recommended \

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file explains that the skill can create a LaTeX paper project and compile/debug it, and the example prompts explicitly mention creating main.tex and references.bib. However, the description does not include any user-facing warning that the skill may create or modify files in the workspace, which is a data-affecting behavior covered by the markdown warning requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The Recommended usage section presents all example user prompts in Chinese, while the skill is otherwise described in English and does not state that language is optional or user-selected. This can be read as implicitly steering usage toward a specific language without an explicit opt-in or language-choice note.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example command includes a Chinese commit message string without offering any language choice or documenting a locale-specific requirement. This can violate language policy expectations because it implicitly prescribes a specific language for users regardless of their preferred locale.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This is a manifest-style JSON file, so vague trigger review applies. The instruction to reuse 'successful experience' from another project is underspecified about what exact materials or boundaries should be used, which could lead to broader-than-intended invocation or behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file contains sudo apt install commands, including texlive-full, which will modify the system and may consume substantial disk space. The surrounding text explains how to install TeX Live but does not provide a user-facing warning that these commands require elevated privileges and will change the host environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language prompt content is consistently written in Chinese, effectively requiring use of a specific language for operating the skill. The file does not offer a language choice or explain a region-specific need, which conflicts with the policy requirement to avoid forcing a locale without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.