Security audit

Paper Results Reverse Engineer

Security checks across malware telemetry and agentic risk

Overview

This is a coherent paper-analysis skill, but it gives the agent broad local PDF access, shell-based PDF extraction, and file-writing behavior without strong user-control boundaries.

Install only if you are comfortable with the agent processing explicitly chosen paper PDFs, running pdftotext locally, and saving Markdown outputs on disk. Prefer uploaded or clearly selected non-confidential PDFs, review where files will be written, and confirm cleanup behavior before running long analyses.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The template explicitly instructs the agent to invoke a local shell command (`pdftotext`) on a supplied PDF path. That expands the skill from text analysis into local command execution, creating unnecessary system-access capability and increasing the risk of misuse, path abuse, or unsafe handling of untrusted files.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The template authorizes use of any local PDF path on the user's machine via `read`/`exec`, which broadens the skill's access surface beyond its stated purpose of analyzing paper Results sections. Allowing arbitrary local-path handling can enable unintended access to sensitive local documents and normalizes agent interaction with the host filesystem.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs file-first output to a desktop directory without requiring explicit user consent or a visible warning about local file creation. In an agent environment with filesystem access, this can lead to unexpected writes of user-provided paper content or derived analysis artifacts onto local storage, creating privacy, persistence, and workspace-integrity risks.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The phased execution flow creates temporary files and later cleans them up, but it does not clearly warn users that intermediate filesystem artifacts will exist during processing. Even if cleanup succeeds normally, temp files can persist after interruption or failure and may expose sensitive document contents or metadata in local storage.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list uses very broad natural-language phrases such as “完整精读”, “用于汇报”, and “做 PPT” without explicit precedence rules, exclusions, or confirmation steps. That can cause unintended activation of the close-reading/full-depth workflow, leading to overbroad processing, higher token/tool usage, and outputs that exceed what the user actually requested.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The example content strongly defaults to Chinese-language interaction and output structure, with no visible opt-in or language negotiation. In practice this can override the user’s preferred language, degrade usability, and create prompt-routing or instruction-following errors in multilingual settings.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example shows a concrete output path on the user's Desktop and states that Markdown was written there, but does not warn that the skill persists analysis artifacts to local storage. Silent or insufficiently disclosed disk writes can expose sensitive research materials, paper notes, filenames, or derived analyses to other local users, backups, sync clients, or later unintended disclosure.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger condition explicitly activates the skill not only for named commands but also when no mode is specified, making invocation overly broad and ambiguous. This can cause the skill to run unintentionally in unrelated conversations, increasing the chance of prompt/skill hijacking, incorrect routing, or unexpected file/output generation without clear user consent.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The test case hardcodes Chinese-language interaction/output expectations without indicating that the agent should adapt to the user's preferred language. This can cause the skill to ignore user language context, reduce accessibility, and create prompt-control behavior where the skill dictates output language instead of following user intent.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The skill appears to require Chinese-language output regardless of the user's preference, which can override user intent and reduce reliability or usability for users expecting another language. In an agent setting, hard-coded output constraints are risky because they can silently interfere with downstream workflows, auditing, accessibility, and accurate communication of research results.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.