paper-rewrite

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:34 AM UTC
• Version: 1.0.0

Overview

This skill provides a paid remote paper-rewriting service, but it sends manuscript text over HTTPS with certificate checks disabled and has weak upfront consent boundaries.

Review before installing. Do not submit confidential, unpublished, personal, or institution-restricted papers unless you are comfortable sending them to this third-party service. Require explicit confirmation before each use and avoid payment authorization until the service uses normal TLS certificate validation and clearly states data handling terms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/rewrite.py:15

Finding

TLS Certificate and Hostname Verification Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/rewrite.py, lines 15-20 and 37-44
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code

python

# Service endpoint
SERVICE_URL = "https://192.144.154.90/demo/a2m/resource"

# Skip self-signed certificate verification
SSL_CONTEXT = ssl.create_default_context()
SSL_CONTEXT.check_hostname = False
SSL_CONTEXT.verify_mode = ssl.CERT_NONE

python

try:
    resp = urllib.request.urlopen(req, context=SSL_CONTEXT, timeout=200)
    data = json.loads(resp.read().decode("utf-8"))
    return data
except urllib.error.HTTPError as e:
    if e.code == 402:
        payment_needed = e.headers.get("Payment-Needed", "")
        body = e.read().decode("utf-8", errors="replace")

Technical Analysis

The script creates an SSL context but explicitly disables both certificate-chain validation and hostname verification. Consequently, HTTPS encryption does not authenticate the remote service. Any certificate presented during the TLS handshake will be accepted, including a certificate controlled by an attacker.

The script transmits up to 30,000 characters of potentially confidential academic manuscript content through this insecure connection. It also trusts the returned JSON response, HTTP status, and Payment-Needed header. A network-positioned attacker can therefore impersonate the rewrite service and inspect or modify application data without needing a certificate trusted by the client.

The use of a bare IP address increases deployment pressure to bypass hostname validation but does not make disabling TLS validation safe.

Attack Path

1. A user invokes the Skill with unpublished or otherwise sensitive manuscript text.
2. The script builds a JSON request containing that text and connects to 192.144.154.90.
3. An attacker obtains a network interception position, such as through a compromised gateway, h ...[truncated 1213 chars]

Remediation

View remediation

Remediation Suggestions

1. Deploy the service under a DNS hostname with a valid certificate issued by a trusted certificate authority.

2. Remove the custom context that disables verification. Use the secure defaults:

   python

   resp = urllib.request.urlopen(req, timeout=200)
   

   Alternatively, retain an explicit default context without weakening it:

   python

   ssl_context = ssl.create_default_context()
   resp = urllib.request.urlopen(
       req,
       context=ssl_context,
       timeout=200,
   )
   

3. Do not set check_hostname to False or verify_mode to ssl.CERT_NONE in production.

4. If a private certificate authority is operationally required, install only that CA as a trust anchor and preserve hostname verification rather than accepting arbitrary certificates.

5. Validate the structure, expected content types, and size of service responses before consuming them.

6. Treat HTTP 402 headers and bodies as untrusted data. Authenticate and validate payment metadata before presenting it for authorization or initiating any payment workflow.

7. Inform users that submitted manuscript text is transferred to an external service and may contain sensitive information.

8. Add automated tests or static-analysis rules that fail builds when certificate verification is disabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises a remote HTTPS endpoint and paid network workflow but does not declare any explicit tool scope or network permission boundaries. This creates a transparency and least-privilege problem: an agent may transmit user content off-platform without clear permission metadata, making unintended exfiltration of sensitive academic text more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes paper rewriting but does not prominently warn that the user's paper text will be transmitted to a remote service endpoint. Because academic papers can contain unpublished research, personal data, or proprietary content, silent transmission creates a meaningful confidentiality risk and may violate user expectations or institutional policies.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad and map common writing-assistance requests directly to this paid external service, without clear boundaries or confirmation. This increases the chance of accidental activation, causing user text to be sent to a third party and potentially initiating a billable workflow when the user may only have wanted local editing help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mentions charging and HTTP 402 payment flow, but it does not present a clear, upfront warning that use may trigger authorization and payment behavior. Users could unknowingly initiate a paid action through a natural-language request, which is especially risky when combined with broad triggers and automatic service invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script transmits full paper content to an external service, which creates a real confidentiality risk because unpublished academic material may contain sensitive, proprietary, or personally identifiable information. This risk is made more severe by the code explicitly disabling TLS certificate verification, so users' text could be exposed to man-in-the-middle interception or sent to an impersonated server without detection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring says the skill accesses the rewrite service '通过 HTTP 402 协议', which implies 402 is the protocol/mechanism of operation. In code, the request is a standard HTTPS POST to SERVICE_URL, and HTTP 402 is only handled in the error path as a payment-required response. This is an intent/documentation mismatch rather than a functional requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language strings and documentation are entirely in Chinese, including the skill description and user prompt, which imposes a language expectation on users without opt-in or explanation. The file does not indicate that the skill is region-specific or provide any language-selection mechanism.

Content

No source excerpt is available for this finding.