Security audit

Abstract Summarizer

Security checks for vulnerabilities and agentic risk

Overview

This summarizer is mostly coherent, but its URL feature can contact arbitrary network addresses without safeguards, so it should be reviewed before installation.

Install only if you are comfortable with a skill that can fetch any URL supplied to it. Avoid using it with private, signed, internal, localhost, or cloud-metadata URLs, and prefer local PDF/text input until URL fetching is restricted and dependencies are pinned.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:287
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The script has undeclared network capability via the --url path, which uses requests.get() to fetch arbitrary remote content. In an agent/skill environment, hidden or undeclared network access expands the trust boundary, can enable SSRF-like access to internal resources, and violates least-privilege expectations for a summarization tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly advertises URL input ('Multi-Format Input: Process PDFs, text, URLs, or clipboard content') and later exposes a --url parameter, but nowhere warns users that remote fetching may initiate outbound network requests and transmit sensitive document URLs or metadata to external hosts. In a summarization context, users may provide private preprints, internal reports, or signed URLs, so the omission can lead to unintended data disclosure or unsafe fetching behavior such as contacting untrusted domains.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Although the skill is described as summarizing papers, it will fetch arbitrary URLs and summarize whatever is returned. This broader behavior is dangerous because it can be abused to make the runtime issue outbound requests to attacker-controlled or internal endpoints, potentially exposing internal metadata/services or processing untrusted remote content outside the declared skill scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The limitation explicitly centers the skill on English-language papers, which is a language/locale constraint. The file does not present this as a user-selectable option or explain a policy-based reason for restricting language support.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency list leaves PyPDF2 unpinned, so builds may resolve to different versions over time, including versions with known security defects. In a document-processing skill, this is relevant because PDF parsers routinely handle attacker-controlled input and historically have been prone to denial-of-service issues such as infinite loops and pathological parsing behavior.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
pypdf2 requests

Unverifiable Dependency: pypdf2 has 8 known advisory(ies) (CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: PyPDF2 has multiple known advisories, and because no version is specified, it is impossible to verify whether installation will pull a fixed or vulnerable release. This is more concerning in this skill than in many others because the stated function is to process academic papers and technical reports, meaning untrusted PDF input is central to the skill's operation and parser flaws could be triggered by malicious documents to cause denial of service or excessive resource consumption.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The requests dependency is also unpinned, which makes the installed version non-deterministic and can expose the skill to older vulnerable releases depending on environment and install time. Because this skill may fetch or process remote resources as part of summarization workflows, a vulnerable HTTP client could contribute to credential leakage, TLS verification issues, or other network-related security problems.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
pypdf2 requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Requests has numerous historical advisories, and without version pinning there is no assurance that a safe release will be installed. If the skill retrieves documents, metadata, or external references over HTTP(S), a vulnerable requests version could enable credential disclosure, improper certificate handling, or other network-layer weaknesses depending on how the library is used elsewhere in the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest says the skill transforms papers into concise abstracts, but does not mention filesystem write behavior. Supporting --output and writing the generated abstract to a user-specified path adds a persistence side effect beyond in-memory summarization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.