Security audit

Paper Contribution Helper

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits a paper-analysis helper, but it overrides the first assistant turn and can send full papers, reviews, replies, and an API credential to a configurable LLM endpoint.

Review this before installing, especially if you work with unpublished papers or confidential reviews. Use only trusted LLM endpoints, verify OPENAI_API_BASE, avoid untrusted command/acpx backends, and expect the skill to read/write project files and generated skill outputs in your workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Forced First-Response Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/engine/analyze_extracted_papers.py:401
Finding: Configurable LLM Endpoint Can Receive API Credentials and Confidential Research Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (136)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Repository traversal for forbidden strings, absolute paths, and compliance checks is a materially different capability from research assistance. That mismatch matters because it increases read access over local files and can surface sensitive path information or embedded tokens if not tightly scoped.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Forcing Chinese for diagnosis, reasoning, ranking, and risk communication removes user choice and can materially reduce transparency if the user or downstream reviewer does not read Chinese. Because these sections convey safety-relevant judgments and workflow decisions, language coercion can obscure risks, inhibit oversight, and make it harder for users to catch incorrect or overreaching actions.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Copying the full parent environment into a subprocess can expose secrets such as API keys, tokens, proxy credentials, and other sensitive runtime variables to whatever executable is launched. Because this file also supports arbitrary command execution, inherited environment variables materially increase the blast radius of that capability and make secret exfiltration easier.
Content: Scanner excerpt · assets/domain-skill-template/scripts/engine/analyze_extracted_papers.py (reported line 449)May include surrounding context.
python
paper_key=paper_key, stage=stage, ) env = os.environ.copy() env.update( { "LLM_REQUEST_JSON": str(request_path),

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/domain-skill-template/SKILL.template.md (reported line 1)May include surrounding context.
md
# Generated Skill Contract ## Required Layout

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/domain-skill-template/references/base_delta/contract_state.md (reported line 1)May include surrounding context.
md
# Generated Skill Contract ## Required Layout

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/domain-skill-template/references/base_delta/initialization_lessons_openreview_project_runs.md (reported line 1)May include surrounding context.
md
# Generated Skill Contract ## Required Layout

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/domain-skill-template/references/base_delta/workflow_knowledge_base_build.md (reported line 1)May include surrounding context.
md
# Generated Skill Contract ## Required Layout

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/domain-skill-template/references/base_delta/workflow_project_discovery.md (reported line 1)May include surrounding context.
md
# Generated Skill Contract ## Required Layout