T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Incorrect and Unpinned DOCX Dependency Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Blind Review Sanitizer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local blind-review sanitizer, but it can re-expose removed identifying information in console output and has under-scoped file/dependency safeguards.
Review before installing or running on sensitive manuscripts. Use only in a local, trusted workspace, avoid shared CI or agent logs, do not pass sensitive manuscripts through environments that capture stdout, and inspect output paths carefully because the script may overwrite existing writable files. The dependency should be corrected and pinned before normal use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:120- Finding
Sanitized Personal Information Is Disclosed in Console Output
- Content
View full analysis
1: print(f" - {item} (x{count})") else: print(f" - {item}") ``` Institution names are handled similarly at `scripts/main.py:120`: ```python self.removed_items.append(f"Institution: {match.group()}") ``` ### Technical Analysis The sanitizer removes identifying information from the generated manuscript but stores each original email address, telephone number, and institution name in `removed_items`. It then emits those raw values to standard output. Standard output is commonly retained by shell capture, CI systems, agent transcripts, orchestration platforms, job telemetry, and centralized logging services. Therefore, the output artifact may be sanitized while the same sensitive identifiers remain available in a separate and potentially more broadly accessible logging channel. This is a confidentiality flaw because the logged content directly conflicts with the purpose of removing identifying information for anonymous review. ### Attack Path 1. An operator processes a manuscr ...[truncated 1179 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:324- Finding
Unrestricted Output Path Allows Silent Overwrite of Arbitrary Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The documented purpose and the described operational behavior are materially inconsistent: the skill claims bounded anonymization workflow properties while apparently performing broader file transformation and identifier removal behavior that is not clearly declared. This mismatch is dangerous because users and agent frameworks may trust the higher-level description, yet invoke code that handles sensitive manuscripts and alters content in ways that are under-specified, leading to confidentiality, integrity, and review-process risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents executable behavior that reads and writes local files but does not declare any tool scope or permissions boundaries. In an agent environment, this creates an authorization ambiguity where reviewers and orchestrators cannot reliably constrain file access, increasing the chance of unintended reads, overwrites, or use outside the intended workspace.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill documentation states that the script accepts
.docx,.md, and.txtinputs and thatpython-docxis optionally required for.docxprocessing. In the provided file, these statements are presented as implemented behavior, but this file contains only manifest/documentation content and no executable logic to substantiate those claims, creating an intent-versus-implementation divergence within the available artifact.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is a real information disclosure issue: after anonymizing the document, the tool prints the exact removed items such as author names, institutions, email addresses, phone numbers, and self-citation phrases to stdout. In academic workflows, CLI output may be captured in terminal history, CI logs, shared notebooks, or support transcripts, which can re-expose the very identifying information the tool is supposed to remove.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is unpinned, so installations may resolve to different versions over time, including releases with breaking changes or newly introduced vulnerabilities. In a skill that processes academic writing artifacts, this creates a supply-chain risk and reduces build reproducibility, though the direct impact is limited by the small dependency surface shown here.
- Content
text docx