T09 · Insecure Skill Coding Practices
Error
- Location
scripts/md_to_docx_final.py:128- Finding
Arbitrary JavaScript Execution Through Insufficient Markdown Escaping
- Content
View full analysis
- Remediation
View remediation
Security audit
academic-paper-citation
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed before installation because it rewrites thesis files at hardcoded local paths and runs generated code during document conversion.
Install only after reviewing the scripts and preferably after replacing hardcoded paths with explicit user-selected input and output paths, adding backups or dry-run diffs before any write, pinning npm dependencies, and fixing the Markdown-to-DOCX converter so document text is serialized as data rather than executable JavaScript.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:29- Finding
Unpinned npm Dependency Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Using fixed local file paths while claiming to be a general citation-management tool is dangerous because it can cause unintended reads or writes to local documents without user awareness. The academic-paper context increases sensitivity because the targeted files may contain private research, student records, or unpublished thesis content.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not clearly warn users that it may modify documents and automatically expand paper content, which is dangerous because users may authorize it without understanding that it can alter substantive academic work. In this context, undisclosed expansion of thesis content can lead to integrity issues, policy violations, and irreversible overwrites of important documents.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generated JavaScript directly interpolates markdown-derived text and output paths into code, but only escapes double quotes. An attacker can include backslashes, newlines, Unicode line separators, or other JavaScript-significant characters in markdown content to terminate strings or alter program structure, leading to arbitrary code execution when Node runs the file.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares shell, file read, and file write capabilities implicitly through documented script execution, but does not scope or constrain those permissions in metadata. That increases the blast radius if the skill is invoked unexpectedly or implemented with unsafe path handling, because it can read and modify local documents without an explicit trust boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill triggers when users mention a long list of topics including broad phrases like “Word转Markdown”, “整理参考文献”, and especially “学术论文字数不够”. These are not tightly scoped to citation automation and lack exclusion conditions or negative examples, which increases the chance of unintended invocation for general writing or formatting requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description repeatedly states the skill is for processing Chinese academic papers and Chinese thesis workflows, but does not present this as an optional or clearly justified locale constraint. Under the language/locale policy, restricting usage to a specific language should either be opt-in or explicitly documented as a necessary limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents its instructions and implementation details exclusively in Chinese, beginning with the title and continuing throughout the document. Under the policy for natural-language violations, forcing a specific language without user opt-in can exclude users unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring is written entirely in Chinese and presents the skill as a Chinese-language converter description, while the code's user-facing messages are also Chinese-only. This indicates a fixed language/locale experience without any opt-in or documented justification, which matches the policy concern for forced language selection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script hardcodes a specific local thesis document path and a fixed output path in a user home directory, which is not appropriate for a reusable conversion skill. In an agent environment, this can cause unintended access to sensitive local files, leak the existence and naming of private academic work, and overwrite files in a predictable location without explicit user consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural language that assumes Chinese as the required language, including the module docstring and later console output. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script is hardcoded to modify a specific local manuscript file and appends a large unrelated appendix, which is behaviorally inconsistent with a citation-management utility. This is dangerous because it silently alters user-authored academic content in place, causing integrity loss and potentially inserting deceptive material into a thesis without review.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script injects extensive prewritten thesis content across multiple domains unrelated to bibliography processing, effectively fabricating academic material. In the context of an academic-paper citation skill, this is especially dangerous because it can facilitate plagiarism, falsification, or undisclosed ghostwriting while appearing to be a legitimate formatting tool.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script writes directly back to the original markdown file without warning, confirmation, backup, or transactional safety. This can irreversibly overwrite important user work, especially when combined with the hardcoded file path and bulk content injection behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and all user-facing messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the policy rule, forced language choice in natural-language content is a reportable issue unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module description and subsequent logic are written specifically for Chinese-language thesis validation, including counting Chinese characters as the primary measure of length. This imposes a locale-specific workflow in natural language and behavior without any opt-in or documented user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a tool for citation management tasks such as extracting references, inserting citation markers, converting Word/Markdown, and expanding thesis length. This file's stated purpose and implementation instead generate per-reference '摘要' summaries from citation contexts, which is a distinct literature-analysis capability not described in the manifest.
- Content
Static analysis
No suspicious patterns detected.