Security audit

Paper Deep Reading

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a coherent paper-analysis helper that reads user-supplied research sources, searches for paper context when available, and writes traceable report artifacts without hidden persistence or exfiltration behavior.

Install this if you want a structured, source-grounded paper-reading workflow and are comfortable with it reading paper/source files you provide and creating multiple output files. Prefer running it in a project/workspace folder, and consider pinning or omitting unused dependencies if your host automatically installs requirements.txt.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
- keep `SKILL.md` as the main instruction file

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly instructs generation of multiple output files and use of local scripts, which implies file read/write behavior, but it does not declare any tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations can cause overbroad execution authority or ambiguous enforcement, increasing the chance the skill reads or writes outside the intended workspace.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill for broad activities like "literature-review tasks," "novelty audits," and "finding new research questions," which are expansive phrases that can overlap with many ordinary research requests. The file does not provide explicit boundaries or negative examples clarifying when the skill should not be invoked versus a simpler summarization or analysis skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script auto-detects language and switches to Chinese whenever enough CJK characters are present, even if the user did not explicitly request that locale. This is a natural-language policy concern because it enforces a locale choice by heuristic rather than user opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified as a minimum version range rather than a pinned, exact version, which makes builds non-reproducible and can pull in different releases over time. In a skill that processes research papers and related inputs, this increases supply-chain uncertainty and can unexpectedly introduce vulnerable or breaking versions of Markdown parsing code.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
markdown>=3.6 pyyaml>=6.0

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: The manifest does not pin markdown, so it is impossible to verify whether the installed version avoids known advisories affecting some Markdown releases. Given this skill's likely use on untrusted document content, a vulnerable parser could enable denial of service or malformed-input handling issues if an affected version is resolved.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: pyyaml>=6.0 is unpinned, so installations may resolve to different versions over time, including releases with security issues or behavior changes. Because this skill likely ingests external paper/project artifacts and configuration-like text, YAML handling is more security-sensitive than a typical utility dependency if unsafe loading is ever used elsewhere in the project.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
markdown>=3.6 pyyaml>=6.0

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The manifest leaves pyyaml unpinned despite multiple historical PyYAML advisories, so the deployed version cannot be verified as safe. In the context of a document-ingestion/research-analysis skill, YAML may appear in project metadata, configs, or supplementary artifacts, making use of a vulnerable or unsafe-loading YAML stack more dangerous than a purely internal dependency.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON template describes the skill purpose but does not define when the skill should or should not activate, nor does it provide specific trigger phrases or exclusion conditions. For manifest-type files, that absence can create overly broad or unclear activation behavior if the template is consumed as-is.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L004 instructs the skill to write the final report in Chinese whenever the user's current request is primarily in Chinese, rather than explicitly asking the user which language they prefer. This is a natural-language locale policy constraint and may override user preference in multilingual contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.