投稿选刊助手

• Outcome: Review
• Latest audit: Sep 22, 2026 · 5:07 PM UTC
• Version: 1.0.5

Overview

The skill’s journal-matching purpose is coherent, but it sends manuscript queries and auth/session data to a private remote service and stores credentials locally without clear user-facing disclosure.

Review before installing if your paper title or abstract is confidential. This skill depends on a remote paid service and may store API keys and session cookies in a local plaintext file, so use it only if you are comfortable with that service receiving your query and managing local credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list is broad and includes common academic phrases such as journal recommendation, paper submission, and open access, which can cause the skill to activate in ordinary conversation beyond the user's explicit intent. In this context, unintended activation could lead the agent to run external data-fetching logic or reshape the response unexpectedly, creating reliability and possible privacy/external-call concerns even though the skill itself is not overtly malicious.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Usage text, comments intended to guide behavior, and all runtime console messages are in Chinese, with no option for another language or indication that the skill is region-specific. This can violate language/locale policy when users are not given an explicit choice or opt-in.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists API keys and session cookies to a plaintext file in the user's home directory without any visible warning, consent flow, or file-permission hardening. If another local user, process, backup system, or malware can read that file, the credentials could be reused to impersonate the user or consume paid quota.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request transmits an Authorization bearer token, installation ID, cookies, and possibly the user's query to a remote service. Although this is part of the script's function, the file does not provide a user-facing disclosure at runtime that these data elements are being sent.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Most end-user instructions and usage guidance are presented only in Chinese, while the policy requires checking for language or locale constraints that are forced without user choice. Although there is a brief English description in metadata, the operational instructions do not clearly offer users a language-selection option.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The manifest presents the skill entirely in Chinese via its name and tags, which can imply a fixed language/locale for discovery and use. There is no indication that users may choose another language or that the Chinese-only scope is intentionally limited to a specific regional audience.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The comment states that no device information is read and specifically says username/hostname are not accessed. However, the code immediately calls `homedir()` and uses that value to create a credential file path under the user's home directory, which is a form of local environment/user-context access. This is not just omitted detail; it weakly contradicts the stated claim about what local information is read.

Static analysis

No suspicious patterns detected.