Paper Reader

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:05 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PDF paper extraction guide with no bundled executable code or hidden high-impact behavior, though its dependency and disclosure hygiene could be improved.

Review the Chinese instructions before installing, use a virtual environment for the Python dependencies, and expect extracted paper content to be written into local output folders such as figures, tables, and paper_output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9 and 29-31
Vulnerability Type: Unpinned and inconsistently named third-party dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

"requires": { "python": ["pdfplumber", "pymupdf", "PIL"] },

bash

pip install pdfplumber pymupdf Pillow

Technical Analysis

The documented installation command retrieves the latest versions of pdfplumber, pymupdf, and Pillow available through the user's configured Python package index. No exact versions, integrity hashes, lockfile, or trusted index are specified. Consequently, dependency resolution is mutable and installations are not reproducible.

The dependency metadata identifies PIL, while the installation command identifies Pillow. Although Pillow is the maintained distribution that provides the PIL import namespace, using inconsistent dependency identifiers can cause incorrect resolution by automated skill installers or encourage attempts to install an unintended package.

Exploitation depends on an attacker influencing a configured package index, compromising one of the named distributions or its dependency chain, or causing an automated installer to resolve an unintended package. This audit found no evidence that any currently named package is malicious.

Attack Path

1. A user or automated skill manager follows the documented installation instructions.
2. pip queries the package indexes configured in the execution environment and resolves packages without fixed versions or expected hashes.
3. An attacker-controlled, compromised, or unexpectedly updated package is selected from the dependency chain.
4. Package installation hooks or subsequently imported package code execute in the Python process.
5. The malicious code receives the permissions of the account or environment performing the installation or running the skill.

Impact Assessment

Successful exploita ...[truncated 468 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version, for example through a version-controlled requirements or lock file.
2. Generate and verify cryptographic hashes for all resolved distributions, using a hash-enforcing installation workflow such as pip install --require-hashes -r requirements.txt.
3. Lock transitive dependencies as well as direct dependencies to make installations reproducible.
4. Use the canonical distribution name Pillow consistently in metadata and installation documentation; reserve PIL only for the Python import namespace.
5. Configure an explicitly trusted package index or an internally reviewed package mirror rather than relying on arbitrary environment-level index configuration.
6. Install dependencies in an isolated virtual environment under a non-privileged account.
7. Add automated dependency integrity, provenance, and vulnerability checks before publishing updated lock files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions and feature descriptions are written in Chinese, which effectively forces a specific language for users who may not understand it. The policy allows locale constraints only when users are given a choice or when the limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file describes an output structure containing generated text, JSON, image, and CSV files, but it does not include any explicit user warning that running the skill will create and populate local directories. Because file creation can affect user data and workspace state, the description should disclose this behavior clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.