Graphical Abstract Wizard

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:04 AM UTC
• Version: 0.1.0

Overview

This skill is a local tool for turning paper abstracts into graphical-abstract recommendations, with no evidence of hidden execution, exfiltration, persistence, or deception.

Reasonable to install for local, non-sensitive abstract processing. Avoid passing confidential or embargoed abstracts on the command line, keep output paths inside a controlled workspace, and remove or pin the unnecessary dataclasses dependency before use in automated or privileged environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; installation instruction at SKILL.md:182-186
Vulnerability Type: Unpinned and unnecessary third-party dependency
Risk Level: Medium

Vulnerable dependency declaration:

text

dataclasses

Associated installation instruction:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project declares Python 3.8 or newer as a prerequisite, but dataclasses has been included in the Python standard library since Python 3.7. Installing the external dataclasses backport is therefore unnecessary for every supported Python version.

The dependency is also declared without an exact version or integrity hash. Consequently, installation behavior depends on the mutable package version resolved from the user's configured Python package index. This creates avoidable supply-chain exposure: if the package, one of its release artifacts, the configured index, or the dependency resolution path is compromised, package-controlled installation code could run before the Skill itself is invoked.

The audit found no evidence that the current dependency is intentionally malicious. The vulnerability is the unnecessary trust placed in an unpinned external component and the absence of reproducible dependency verification.

Attack Path

1. A user follows the prerequisite instructions in SKILL.md.
2. The user runs pip install -r requirements.txt.
3. Pip resolves the unversioned dataclasses package through the user's configured package index.
4. If the selected distribution or package-index path has been compromised, attacker-controlled package installation logic executes.
5. That logic runs with the permissions of the user or automation account invoking pip and can access resources available to that account.

Impact Assessment

Exploitation could provide code execution with the privileges of the account pe ...[truncated 595 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove dataclasses from requirements.txt, because all supported Python versions provide it through the standard library.
2. If support for Python versions older than 3.7 is intentionally introduced, declare the backport with an exact version and an appropriate environment marker, for example:

   text

   dataclasses==<reviewed-version>; python_version &lt; "3.7"
   

3. Generate and enforce cryptographic hashes for any required third-party distributions, such as by using a locked requirements file and pip install --require-hashes.
4. Install packages only from an explicitly trusted package index.
5. Perform dependency installation in an isolated, non-privileged virtual environment or container.
6. Update SKILL.md after removing the dependency so that the documented installation procedure does not instruct users to install unnecessary packages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/main.py (reported line 524)May include surrounding context.

python

The illustration should communicate innovation, precision, and scientific rigor."""
        
        return prompt


def format_output(result: AnalysisResult, format_type: str) -> str:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation indicates file read and file write capabilities, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what filesystem access is intended and increases the chance of overbroad access when integrated into an agent runtime, especially since the skill accepts input from files/stdin and writes to arbitrary output paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as analyzing abstract text, but the CLI also accepts arbitrary local file paths for input and arbitrary output paths for writes. In an agent setting, this expands the trust boundary: a caller can cause the skill to read unintended local files and write results to attacker-chosen locations, which can expose sensitive data or clobber local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages users to pass paper abstracts via command line, stdin, and output files, but it does not warn that abstracts may contain unpublished or confidential research data. This can lead to inadvertent disclosure through shell history, redirected files, shared workspaces, or downstream use with optional external AI services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency in requirements.txt is unpinned, which can lead to non-reproducible installs and accidental uptake of newer package versions with breaking changes or newly introduced malicious code. In this specific file the risk is somewhat limited because dataclasses is a well-known package/backport, but leaving versions unconstrained still weakens supply-chain integrity.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The module docstring usage examples show '-a' as taking raw abstract text and separately suggest stdin for file content, while the argument help later states '-a' may also be a file path and the code opens it as such. This is an active documentation mismatch about how input is interpreted, which can change the skill's effective behavior from text processing to local file access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.