biomedical-paper-billing

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:17 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it should be reviewed because it can send manuscript citation details to external search services and automatically replace references without clear user approval.

Review this skill before installing if you work with unpublished manuscripts, patient-adjacent data, confidential thesis drafts, or citation-sensitive biomedical writing. Use it only when you are comfortable with external citation lookups, and require the agent to ask before sending search queries, adding or replacing references, or writing final DOCX files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a high-level manuscript generation system with AI writing capabilities and specialized biomedical/thesis workflows. The supplied code chunk only handles document construction and light markdown-like parsing using python-docx. It formats paragraphs, headings, formulas, and references into a Word document, but does not generate content, translate or transform Chinese input, perform any domain-specific manuscript assembly, or implement the claimed specialized formats. While DOCX generation is consistent with part of the description, the primary purpose and major capabilities are materially overstated relative to the actual code.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The activation description states the skill activates when a user provides a Chinese draft and requests a full English research paper, establishing a fixed language transformation behavior. Under the language-policy rule, forcing a specific output language without an explicit user choice or opt-in is a natural-language policy concern unless clearly justified as region-specific.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates PubMed or batch_web_search verification of references without warning that citation or manuscript-derived information may be sent to external services. In biomedical and thesis contexts, drafts may contain unpublished, sensitive, or identifying content, so undisclosed network transmission increases confidentiality and privacy risk.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly instructs the agent to replace unverifiable references with newly searched literature, which crosses from formatting assistance into substantive content authorship. This is dangerous because it can silently introduce citations the user did not provide and may misrepresent evidentiary support, especially in biomedical writing where citation fidelity is critical.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The workflow directs creation of multiple .docx artifacts and mapping files without clearly informing the user that files will be generated and saved. While not directly exploitable on its own, silent file creation can violate user expectations, clutter workspaces, and create accidental disclosure risk if sensitive manuscript content is written to disk unexpectedly.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The embedded example code writes /workspace/output.docx directly to disk without any accompanying warning or confirmation step. This can lead to unanticipated local file creation and persistence of potentially sensitive manuscript content, especially if users assume the skill only returns text.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The document contains a natural-language instruction to use "British English for Lancet family." This is a locale/language constraint, and the file does not indicate user opt-in or explain that the requirement applies only when targeting those journals, which can conflict with the policy against forcing a specific language without choice or clear justification.

Static analysis

No suspicious patterns detected.