Security audit

newpaper

Security checks for vulnerabilities and agentic risk

Overview

This poster-generation skill is purpose-related but asks the agent to automatically download and run mutable external code while storing API credentials in a plaintext file.

Install only if you are comfortable letting the skill download and run code from the specified GitHub repository, install packages into a Conda environment, and send paper content to the configured model provider. Use a disposable workspace or sandbox, inspect and pin the repository first, avoid sensitive unpublished papers unless the provider is trusted, and prefer environment-injected or temporary credentials over a persistent .env file.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:25
Finding: Unpinned Remote Repository Retrieval and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:69
Finding: Unsafe Plaintext API Credential File Construction
Content: View full analysis
.env << EOF OPENAI_API_KEY=用户提供的值 OPENAI_BASE_URL=用户提供的值 WORKSPACE_DIR=${WORKSPACE_DIR:-./workspace} EOF ``` ### Technical Analysis The skill directs the agent to place a user-provided API key and base URL into a plaintext `.env` file through an unquoted shell heredoc. It does not require input validation, safe serialization, restrictive file permissions, endpoint allowlisting, or cleanup after execution. An unquoted heredoc performs shell parameter expansion, command substitution, and arithmetic expansion on its body when interpreted by a shell. If raw user input is substituted into this command before execution, crafted values containing shell metacharacters or command substitutions may be evaluated. Multiline values can also inject additional environment entries or alter the resulting configuration. Separately, accepting an arbitrary `OPENAI_BASE_URL` allows credentials and paper-derived content to be sent to an attacker-controlled OpenAI-compatible endpoint. A malicious endpoint can collect the API key from authorization headers and retain any document content included in model requests. The resulting `.env` file is created using the process's current umask. The skill does not explicitly set permissions to `0600`, so the credential may be readable by other local users or processes depending on environment configuration. The file is also left behind after execution. ### Attack Path #### Shell or Configuration Injection 1. The skill asks the user for an API key and base URL. 2. An attacker supplies a value containing a newline, shell substitution syntax, or additional environment assignments. 3. The agent inserts the value into the unquoted heredoc command. 4. The shell may evaluate substitutions while constructing `.env`, or the crafted value may alter sub ...[truncated 1601 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 30)May include surrounding context.
md
- [x] [2025.9.3] We now support generate per section content in **parallel** for faster generation, by simply specifying `--max_workers`. - [x] [2025.5.27] We release the [arXiv](https://arxiv.org/abs/2505.21497), [code](https://github.com/Paper2Poster/Paper2Poster) and [`dataset`](https://huggingface.co/datasets/Paper2Poster/Paper2Poster)  **PosterAgent** is a top-down, visual-in-the-loop multi-agent system from `paper.pdf` to **editable** `poster.pptx`.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
md

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 40)May include surrounding context.
md
  ## 📋 Table of Contents

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to clone a remote GitHub repository directly into the current directory and then rely on that code for execution. This introduces an untrusted code execution path and supply-chain risk that is broader than the user’s simple request to convert a PDF into a poster, especially because the repository can change over time and no pinning, integrity check, or review step is required.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill explicitly asks the agent to solicit an OPENAI_API_KEY from the user, which is a sensitive credential. Collecting secrets inside a general-purpose skill is dangerous because the secret may be exposed to the model, tool traces, logs, or subsequent filesystem operations.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
### 第五步：配置 API 密钥检查当前目录下是否有 .env 文件。如果没有，询问用户提供： - `OPENAI_API_KEY`（例如 UniAPI 的 sk-xxx 或 MiniMax 的 sk-xxx） - `OPENAI_BASE_URL`（例如 https://hk.uniapi.io/v1 或 https://api.minimaxi.com/v1）

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The instruction to create a .env file for credentials turns credential collection into persistent plaintext storage. That materially increases the blast radius if the workspace is later inspected, archived, synced, or committed.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

OPENAI_API_KEY（例如 UniAPI 的 sk-xxx 或 MiniMax 的 sk-xxx）

OPENAI_BASE_URL（例如 https://hk.uniapi.io/v1 或 https://api.minimaxi.com/v1）

创建 .env 文件并写入：

bash
cat > .env << EOF

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Including OPENAI_API_KEY directly in the here-document shows the skill is designed to write the credential value into a file verbatim. This is a concrete secret-handling vulnerability, not merely incidental mention of a credential, because it operationalizes secret persistence in a commonly exposed format.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
创建 .env 文件并写入：

bash
cat > .env << EOF OPENAI_API_KEY=用户提供的值 OPENAI_BASE_URL=用户提供的值 WORKSPACE_DIR=${WORKSPACE_DIR:-./workspace}

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 61)May include surrounding context.
Install Libreoffice

bash
sudo apt install libreoffice

or, if you do not have sudo access, download soffice executable directly: https://www.libreoffice.org/download/download-libreoffice/, and add the executable directory to your $PATH.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 64)May include surrounding context.
Install Libreoffice

bash
sudo apt install libreoffice

or, if you do not have sudo access, download soffice executable directly: https://www.libreoffice.org/download/download-libreoffice/, and add the executable directory to your $PATH.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 100)May include surrounding context.
Install Libreoffice

bash
sudo apt install libreoffice

or, if you do not have sudo access, download soffice executable directly: https://www.libreoffice.org/download/download-libreoffice/, and add the executable directory to your $PATH.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises automatic web/logo search via DuckDuckGo or Google Custom Search but does not clearly disclose that institution names, conference names, or metadata inferred from the paper may be sent to third-party services. In a tool that processes unpublished or sensitive papers, this can leak confidential affiliations, venues, or research context to external providers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description says it will fetch code from GitHub and install dependencies but does not warn that this means executing untrusted external code. That omission undermines informed consent and makes users more likely to authorize risky behavior without understanding the supply-chain implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad and likely to match ordinary requests about making a poster from a paper, causing the skill to activate in situations where the user did not explicitly consent to repository cloning, package installation, or credential handling. Because activation leads to sensitive actions, over-broad triggering materially increases the chance of unsafe execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs the agent to create or modify a Conda environment and install Python packages, which changes the local execution environment and may introduce unsafe package execution during installation. This expands the skill’s capabilities into environment management and dependency execution without clear isolation or safety controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to collect API credentials and persist them into a local .env file. Storing secrets in plaintext on disk increases the risk of credential disclosure through logs, workspace sharing, later tool access, or accidental inclusion in version control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill omits a clear warning that it will create a local .env file containing the user’s API credentials. Users may reasonably expect credentials to be used transiently, so failing to disclose persistence increases the chance of unintended secret exposure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 81% confidence
Finding: The skill is designed to send user-provided API credentials and likely paper contents or derived prompts to third-party API endpoints such as UniAPI or MiniMax. External transmission is expected for the task, but it is still security-relevant because the skill does not clearly bound what data will be sent or require explicit informed consent before transmission.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
检查当前目录下是否有 .env 文件。如果没有，询问用户提供： - `OPENAI_API_KEY`（例如 UniAPI 的 sk-xxx 或 MiniMax 的 sk-xxx） - `OPENAI_BASE_URL`（例如 https://hk.uniapi.io/v1 或 https://api.minimaxi.com/v1）创建 .env 文件并写入：

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The heading includes both English and Chinese, but the document does not explain language expectations or offer users a choice of output language/locale. Under the stated policy, natural-language content that implicitly imposes or mixes locales without opt-in can be a documentation-level locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description and all user-facing instructions are written in Chinese, and the trigger examples assume Chinese-language interaction. There is no indication that users may choose another language or that Chinese-only operation is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.