Security audit

Arxiv Watcher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent arXiv paper watcher with limited local bookmarking, but it should treat fetched paper metadata as untrusted content.

Install only if you are comfortable with the skill fetching arXiv data over the network and saving starred paper metadata locally. Treat paper titles, abstracts, authors, and links shown by the skill as untrusted external content, and avoid following suspicious links or treating metadata text as instructions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv_watcher.py:23
Finding: ArXiv API Responses Are Retrieved over Unencrypted HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv_watcher.py:151
Finding: Untrusted Feed Metadata Is Rendered as Markdown and Persisted Without Sanitization
Content: View full analysis
200 else abstract ``` The values are interpolated directly into Markdown: ```python def format_paper_markdown(paper: dict, is_starred: bool = False) -> str: """Format a paper as Markdown.""" star = "⭐ " if is_starred else "" lines = [ f"## {star}[{paper.get('id', 'N/A')}] {paper.get('title', 'No title')}", "", f"**Authors:** {', '.join(paper.get('authors', []))}", f"**Category:** {paper.get('category', 'N/A')}", f"**Submitted:** {paper.get('published', 'N/A')}", "", f"**Abstract:**", paper.get('abstract_preview', 'No abstract available'), "", "**Links:**", f"- arXiv: {paper.get('url', 'N/A')}", f"- PDF: {paper.get('pdf_url', 'N/A')}", "", "---", "" ] return "\n".join(lines) ``` Fetched metadata can then be persisted: ```python else: paper["starred_at"] = datetime.now().isoformat() starred[arxiv_id] = paper save_starr ...[truncated 2428 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad natural-language phrases such as "check arxiv," "new papers," and especially "latest papers on," which are common expressions that may appear in ordinary conversation. This can cause unintended invocation of the skill, leading the agent to fetch external content or alter reading-list state when the user did not explicitly intend to use this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code creates and writes to assets/starred.json, which persists user-selected paper metadata on disk. Although the behavior is part of the 'star' feature, the file-writing side effect is not disclosed in a user-facing warning or confirmation near the operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.