Security audit

Circos Plot Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is scoped to local manuscript anonymization, but it needs review because it can expose removed identifiers in logs, overwrite files, and installs an inconsistent unpinned DOCX dependency.

Install only after reviewing the dependency declaration and use it on copies of manuscripts, not originals. Avoid running it in shared or logged terminals until the summary output is changed to counts-only, and manually verify DOCX acknowledgments, metadata, figures, headers, footers, and supplementary files before submission.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Incorrect and Unpinned DOCX Dependency Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
``` 2. Pin an exact version after compatibility and vulnerability review. 3. Generate and enforce cryptographic hashes, for example with a locked requirements file and `pip install --require-hashes`. 4. Configure package installation to use an approved package index. 5. Add a clean-environment test that installs dependencies and verifies: ```python from docx import Document ``` 6. Add dependency vulnerability and provenance scanning to CI. 7. Keep the package name consistent across `requirements.txt`, `SKILL.md`, and runtime error messages. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:108
Finding: Sanitized Personal Information Is Disclosed in Console Output
Content: View full analysis
str: """Remove contact information (email, phone)""" result = text # Remove email matches = re.finditer(EMAIL_PATTERN, result, re.IGNORECASE) for match in list(matches)[::-1]: self.removed_items.append(f"Email: {match.group()}") result = result[:match.start()] + '[EMAIL]' + result[match.end():] # Remove phone matches = re.finditer(PHONE_PATTERN, result) for match in list(matches)[::-1]: self.removed_items.append(f"Phone: {match.group()}") result = result[:match.start()] + '[PHONE]' + result[match.end():] return result ``` `scripts/main.py:150-156`: ```python else: def replace_func(match): self.removed_items.append(f"Self-citation: {match.group()}") return '[PREVIOUS WORK]' result = re.sub(pattern, replace_func, result, flags=re.IGNORECASE) ``` `scripts/main.py:346-354`: ```python print(f"Items processed: {len(sanitizer.removed_items)}") if sanitizer.removed_items: print("Summary:") for item in set(sanitizer.removed_items): count = sanitizer.removed_items.count(item) ...[truncated 1923 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:205
Finding: DOCX Acknowledgment Section Bodies Remain in Blinded Documents
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:316
Finding: Arbitrary Output Paths Are Silently Overwritten Without Input-Path Protection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented description understates and partially misrepresents the actual behavior, including local file processing, identifier removal, and self-citation handling. Security reviewers and users rely on the description to understand risk; when behavior exceeds or differs from the declaration, they may approve or run the skill without recognizing data-modification, privacy, or integrity consequences.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents execution of a local Python script that reads and writes user-supplied files, but it does not declare an explicit tool/permission scope. That creates an authorization and review gap: consumers may not realize the skill needs filesystem access, and downstream enforcement systems cannot restrict or audit those capabilities precisely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The tool records removed items including raw institution names, email addresses, phone numbers, and self-citation text, then prints them to stdout in the summary. In an anonymization workflow, that creates a direct information disclosure channel through terminal logs, CI logs, shell history capture, or shared execution environments, undermining the privacy goal of the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest repeatedly frames missing identifiers as a bounded stop/fallback condition for safe anonymization, especially at L076-L079 and L138, but the parameter table declares --authors optional. This creates an intent mismatch in the skill documentation about whether identifiers are required for reliable operation versus merely improving detection.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified without a version pin, so installs may resolve to different releases over time, including versions with newly introduced vulnerabilities or breaking changes. This weakens build reproducibility and increases supply-chain risk, especially if an upstream package is compromised or a malicious version is published.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
docx

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level documentation says the tool performs 'one-click removal of author names, affiliations, acknowledgments, and excessive self-citations.' In practice, --keep-acknowledgments disables acknowledgment removal, so the documentation overstates mandatory behavior and contradicts the actual configurable implementation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code performs a file write of sanitized manuscript content via doc.save(output_path). Although the tool's purpose is anonymization, there is no nearby user-facing warning or comment that the processed manuscript will be saved as a new file containing modified content, which is the kind of data-affecting operation SQP-2 asks to disclose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code writes transformed text lines to output_path, which changes how user manuscript data is stored. While the CLI prints input/output paths later, there is no explicit disclosure near the write path that a sanitized copy of the original content is being created, so the data-affecting write lacks clear warning context under SQP-2.
Content: No source excerpt is available for this finding.