Paper Contribution Helper

• Outcome: Review
• Latest audit: May 28, 2026 · 9:15 AM UTC
• Version: 1.0.2

Overview

This paper-analysis skill is mostly coherent, but it includes optional paths that can run user-configured local commands and pass sensitive paper content to external or local LLM backends.

Install only if you are comfortable with a research helper that reads and stores paper/review content locally. Avoid using the command or command-file LLM providers unless you fully trust the configured executable and environment, and do not process confidential unpublished work through external APIs without explicit permission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (34)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

prompt_file.write_text(prompt, encoding="utf-8")
    command = build_command(request, request_json, response_json, prompt_file)

    proc = subprocess.run(
        command,
        capture_output=True,
        text=True,

• Confidence: 96% confidence
• Finding: The code executes an external program via subprocess using a command derived from environment-controlled configuration. Although shell=True is not used, this still creates a code-execution bridge whose behavior can be redirected to arbitrary binaries or scripts if the environment is attacker-influenced. In a helper skill, this materially expands the trust boundary and can lead to arbitrary local command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"LLM_STAGE": stage,
            }
        )
        proc = subprocess.run(
            shlex.split(rendered, posix=(os.name != "nt")),
            capture_output=True,
            text=True,

• Confidence: 93% confidence
• Finding: The code executes a user-configurable command via subprocess using args.llm_command after string formatting with request/response paths and metadata. Although shell=True is not used, this still permits arbitrary program execution if an attacker can control configuration, and the child process receives a full copy of the parent environment, which may include secrets such as API keys and credentials.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not args.llm_command:
            raise RuntimeError("--llm-command is required for provider=command")
        request = {"paper_key": paper_key, "stage": stage, "prompt": prompt}
        proc = subprocess.run(
            shlex.split(args.llm_command),
            input=json.dumps(request, ensure_ascii=False),
            capture_output=True,

• Confidence: 90% confidence
• Finding: This path runs args.llm_command directly as a subprocess and feeds it paper content, review text, and prompts over stdin. Any attacker-controlled or unsafe configuration can therefore execute arbitrary local code under the agent's privileges, creating a strong code-execution boundary that is especially risky in an automation skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

prompt_file.write_text(prompt, encoding="utf-8")
    command = build_command(request, request_json, response_json, prompt_file)

    proc = subprocess.run(
        command,
        capture_output=True,
        text=True,

• Confidence: 94% confidence
• Finding: The file executes an external command via subprocess.run using a command vector built from environment-controlled values and request-derived placeholders. Although shell=False avoids classic shell injection, this still enables arbitrary program execution if an attacker can influence the environment or deployment configuration, which is dangerous for a skill advertised as a paper-assistance helper.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"LLM_STAGE": stage,
            }
        )
        proc = subprocess.run(
            shlex.split(rendered, posix=(os.name != "nt")),
            capture_output=True,
            text=True,

• Confidence: 93% confidence
• Finding: This path executes a user-configurable local command as an LLM backend via subprocess.run after formatting attacker-influenced values such as request/response paths, paper_key, and stage into the command string. Even though shell=True is not used, the capability is still dangerous because the skill's stated purpose is paper analysis, not arbitrary program execution, so a misconfigured or malicious llm_command can execute unintended binaries and operate on sensitive local files.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not args.llm_command:
            raise RuntimeError("--llm-command is required for provider=command")
        request = {"paper_key": paper_key, "stage": stage, "prompt": prompt}
        proc = subprocess.run(
            shlex.split(args.llm_command),
            input=json.dumps(request, ensure_ascii=False),
            capture_output=True,

• Confidence: 90% confidence
• Finding: This code executes args.llm_command directly as a subprocess and feeds it full prompt content, which can include extracted paper text, reviews, and replies. In a paper-analysis skill, allowing arbitrary local command execution is an unnecessary privilege expansion that enables code execution, data theft, or destructive actions if the command is attacker-controlled or points to an unsafe wrapper.

Tainted flow: 'command' from os.environ.get (line 98, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

prompt_file.write_text(prompt, encoding="utf-8")
    command = build_command(request, request_json, response_json, prompt_file)

    proc = subprocess.run(
        command,
        capture_output=True,
        text=True,

• Confidence: 98% confidence
• Finding: There is a tainted flow from environment variables into the command executed by subprocess.run. PAPER_HELPER_ACP_COMMAND is rendered from request fields and split into argv, and alternate environment variables can also select the binary, so an attacker controlling deployment or runtime environment can cause execution of unintended programs. This is a genuine command-execution risk even without shell metacharacter injection.

Tainted flow: 'command' from os.environ.get (line 98, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

prompt_file.write_text(prompt, encoding="utf-8")
    command = build_command(request, request_json, response_json, prompt_file)

    proc = subprocess.run(
        command,
        capture_output=True,
        text=True,

• Confidence: 97% confidence
• Finding: There is a real tainted flow from os.environ-controlled command configuration into subprocess.run. An attacker who can set PAPER_HELPER_ACP_COMMAND, PAPER_HELPER_ACPX_BIN, PAPER_HELPER_ACPX_NODE, or related variables can redirect execution to arbitrary binaries or scripts, turning this helper into a code-execution trampoline.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script implements a generic bridge to execute ACP/Node commands configured externally, which is broader than the documented purpose of a paper contribution helper. This mismatch matters because users and reviewers may reasonably expect a domain helper, not a general-purpose process launcher tied to prompt content and environment state. The broader capability increases abuse potential and makes other execution flaws more dangerous in context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This is a capability mismatch: the skill claims research-assistance behavior but includes a generic bridge for launching externally configured ACP/Node commands. That broad execution surface materially increases risk because users and reviewers would not expect arbitrary local program execution from this skill context.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The helper is presented as modular and self-contained, but core behavior is delegated to arbitrary ACP CLI commands configured via environment variables. This hidden indirection makes the skill more dangerous because the effective behavior can change at runtime without code changes or user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script explicitly supports `--llm-provider=command` and `command-file` with a user-supplied `--llm-command`, then later passes that command into downstream analysis. That creates a built-in arbitrary program execution surface that is unrelated to the core paper-helper function and becomes dangerous if untrusted configs, wrappers, or generated build recipes can influence these arguments.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script does substantially more than 'helper construction': it enumerates accepted ICLR submissions, fetches forum content, scores papers for novelty risk, downloads PDFs, and packages materials to local storage. In the context of a paper-contribution helper, bulk harvesting and structured packaging of papers plus review artifacts increases the chance of unintended large-scale data collection and downstream misuse beyond the user’s likely expectations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code retrieves and stores official reviews, meta reviews, decisions, reviewer follow-ups, and public comments at scale, then uses them to classify 'novelty risk' and generate candidate flags. Within this skill’s context, that is more dangerous than a generic crawler because it operationalizes reviewer/forum harvesting into a reusable pipeline for profiling papers and packaging discussion content, which can expose sensitive or context-dependent review material and facilitate misuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper transmits full paper text and potentially review/reply content to external LLM APIs, which may expose unpublished research, reviewer comments, or other sensitive material outside the local environment. In this skill context, the transmission is functionally related to analysis, but it still creates a real confidentiality and compliance risk if users are not explicitly informed and no minimization controls are applied.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The command-mode LLM backend allows the skill to run arbitrary local commands, which is not necessary for ordinary paper contribution analysis and materially increases attack surface. If an attacker can influence configuration or convince a user to enable an unsafe command, this becomes an execution primitive with access to local data and the prompts supplied by the tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file-exchange mode writes prompts to disk, propagates environment variables, formats a command string, and then executes it, creating a broad local execution and data exposure surface. For a paper helper, this is especially risky because it combines sensitive content staging with arbitrary process launch, enabling leakage of prompt data, abuse of inherited environment variables, and unintended filesystem access.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template explicitly forces Chinese for diagnosis, reasoning, ranking, and risk output without checking user preference or system policy. This can override expected language behavior, reduce transparency for users who cannot read Chinese, and make security-relevant analysis harder to review or audit.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file hard-codes Chinese for most diagnostic and planning content regardless of the user's requested language. In an agent skill, this can override user intent, reduce usability, and create safety/compliance issues when users cannot adequately review nuanced claims, risks, or manuscript-ready guidance in their preferred language.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The workflow hard-codes a response language and ordering requirement ('plain Chinese first') regardless of the user's stated preferences. In an agent setting, this can override higher-priority user expectations, reduce usability, and create prompt-conflict behavior where the system follows embedded workflow text instead of the active request.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script writes the full prompt to a sidecar file on disk without any visible access controls, minimization, or disclosure in the code path. If prompts contain unpublished paper text, API data, credentials, or proprietary material, this creates a confidentiality risk through residual local artifacts. In this skill context, users are likely to process sensitive research content, making silent persistence more concerning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends extracted paper text, reviews, replies, and synthesized prompts to an external LLM API. In this skill context, that content may include unpublished research, reviewer commentary, or other sensitive material, and the code provides no consent gate, redaction step, or prominent disclosure before transmission.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The workflow directs the assistant to write `assistant_deep_read_records.jsonl` and then run an import step that updates project state, but it does not require an explicit user confirmation before modifying files. In an agent setting, implicit file writes can violate user expectations and create integrity or workflow-safety issues, especially if the assistant acts on ambiguous prompts or the wrong run directory.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The contract hard-codes Chinese as the main report language without indicating that this should be conditional on user preference. This can override a user's requested language or reduce usability, transparency, and reviewability for users expecting another language, which is a real policy and safety issue even if not a direct security exploit.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The contract hard-codes a response language ('Use Chinese for diagnosis, reasoning, ranking, risks, anonymous analogies, and revision planning') without user opt-in. This can override user preferences or downstream system expectations, creating prompt steering and reduced usability; in a security-sensitive workflow, forced language can also hinder reviewer visibility and policy auditing if operators cannot easily inspect the output.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.