Paper Management System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 2.0.2

Overview

This PDF paper-management skill is mostly purpose-aligned, but it includes an unsafe notification command path and under-disclosed automatic file deletion/renaming behavior that users should review before installing.

Review this skill before installing. Use it only on directories you intentionally dedicate to paper management, avoid enabling cron until you understand the move/rename/delete behavior, and leave notifications disabled unless the shell command execution path is fixed or tightly controlled. Do not assume the advertised AI summarization sends data to OpenAI in this version; the inspected code appears to summarize locally despite OpenAI-related configuration and dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ai_summarize.py:150

Finding

Shell Command Injection Through PDF-Controlled Notification Content

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/auto_index.sh:43

Finding

Undocumented Permanent Deletion of Duplicate Downloads

Content

View full analysis

> "$LOG" rm -f "$f" fi ``` ### Technical Analysis When a downloaded PDF has a hash already present in the database, the automatic indexing script permanently deletes the file with `rm -f`. The documented behavior describes hash deduplication as skipping an existing file, but it does not clearly state that the copy in the downloads directory will be deleted. The target directory is configurable through `PAPERMGR_DOWNLOADS_DIR`. Consequently, deletion is not necessarily restricted to a directory inside the project. Although the loop only processes regular files matching `*.pdf`, the action remains destructive and has no confirmation, quarantine, backup, or recovery mechanism. This is not arbitrary file deletion: the target must be a regular PDF in the configured downloads directory, its name must contain one of the accepted keywords, and its MD5 hash must already be recorded. Nevertheless, it can cause unexpected data loss where users interpret “skip” as leaving the source file unchanged. ### Attack Path 1. A PDF hash is already recorded in the configured SQLite database. 2. A matching PDF with a qualifying filename is placed in the configured downloads directory. 3. The periodic `auto_index.sh` workflow calculates its MD5 hash. 4. The database query reports that the hash already exists. 5. Instead of leaving the duplicate untouched, the script executes `rm -f "$f"`. 6. The file is permanently removed without user confirmation or a recovery location. An attacker with the ability to place files in the configured downloads directory could intentionally trigger deletion of duplicate copies, although such an attacker would generally already possess write access to that directory. ### Impact Assessment The dir ...[truncated 466 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:4

Finding

Unbounded and Unhashed Third-Party Dependencies

Content

View full analysis

=1.23.0 # AI summarization (optional) openai>=1.0.0 anthropic>=0.20.0 # Configuration pyyaml>=6.0 # Development pytest>=7.0.0 pytest-cov>=4.0.0 ``` ### Technical Analysis All dependencies use open-ended lower bounds and none are protected by package hashes. A future installation can therefore resolve versions that did not exist or were not reviewed when this skill was audited. This makes deployments non-reproducible and expands exposure to compromised upstream releases, malicious dependency updates, and unexpected compatibility changes. The same requirements file also installs optional AI SDKs and development packages into runtime environments. The audited implementation does not import either the OpenAI or Anthropic SDK, so these packages unnecessarily increase the dependency and transitive-dependency attack surface. No evidence was found that the listed package names are typosquatted or currently malicious. This finding concerns unsafe dependency management rather than a confirmed malicious package. ### Attack Path 1. A user follows the documented command `pip install -r requirements.txt`. 2. The package resolver selects any available versions satisfying the open-ended minimum constraints. 3. A selected current or future release may differ from the version tested by the project. 4. If an upstream package or transitive dependency is compromised, its distributed code becomes part of the application environment. 5. Depending on the artifact and package behavior, malicious code could run during installation or when the affected package is imported or invoked. ### Impact Assessment The exact impact depends on the compromised dependency and when its code executes. Potential consequences include: - Code execution with the privile ...[truncated 463 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README says AI summarization can be enabled but does not warn that full PDF text may be transmitted to an external API provider. Because research papers may contain unpublished, licensed, or sensitive content, failing to disclose external data transfer creates a meaningful confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes a configurable external notification command that can execute arbitrary programs and exfiltrate paper summaries outside the application boundary. In a literature-management context, this greatly expands attack surface beyond the stated purpose and creates both command-execution and unintended data-disclosure risk, especially since summaries may contain proprietary or sensitive research text.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a classic tool-parameter abuse issue: a shell-enabled subprocess is fed a constructed command string derived from configurable parameters and content. Because the feature executes in the host environment, successful abuse can lead to arbitrary command execution, lateral movement, or persistence, making the skill context significantly more dangerous than a simple local notifier.

Content

Scanner excerpt · scripts/ai_summarize.py (reported line 154)May include surrounding context.

python

# 执行外部通知命令
    try:
        cmd = f'{notify_cmd} "{title}" "{message[:1500]}"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            print(f"✓ 通知已发送")
            return True

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The user-facing documentation is entirely in Chinese, including commands and descriptions, with no indication that other languages are supported or that the language choice is intentional and limited to a specific audience. Under the stated policy, forcing a specific language without opt-in or justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes an automated workflow that moves files from downloads/ into papers/ and renames them, but it does not clearly warn users that their original filenames and directory placement will be changed automatically. In a file-management skill, undocumented destructive or state-changing behavior can cause confusion, broken references, accidental data loss, or processing of the wrong files, especially when run unattended via cron.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises operational behavior that clearly implies shell execution, file reads/writes, and environment variable access, but it does not declare any explicit tool scope or permission boundaries. This creates an overbroad-trust condition where an agent may invoke powerful capabilities without transparent user review or least-privilege constraints, increasing the risk of unintended file modification, data exposure, or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and primary content are written in Chinese, and the file does not indicate that the skill supports other languages or that Chinese is a required locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring describes an 'AI智能文献提炼模块' with configuration for AI providers and models such as OpenAI/Anthropic. However, the implementation generates summaries entirely through local section extraction and string truncation in generate_summary, and never invokes any AI provider or model. This is a clear mismatch between the advertised behavior and the actual code behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The save_summary docstring states it saves 'AI提炼结果', and the module-level comments repeatedly describe the feature as AI-based summarization. In reality, the code never calls an AI system; it extracts sections with regex and concatenates them into a formatted summary. This is an active contradiction in the code documentation, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function transmits generated summary content to an external command without an explicit user-facing warning, confirmation, or data-classification check. Even if the command is intended for local notification, the design permits silent disclosure of research content to arbitrary handlers, which is risky in environments managing unpublished or licensed documents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The code builds a shell command string from configurable input (notify_cmd) plus dynamic content (title and message) and executes it with shell=True. This creates a command-injection surface and allows arbitrary OS command execution if the configuration or any interpolated argument contains shell metacharacters or crafted quoting, which is especially dangerous because the feature is unrelated to core summarization behavior.

Content

Scanner excerpt · scripts/ai_summarize.py (reported line 154)May include surrounding context.

python

# 执行外部通知命令
    try:
        cmd = f'{notify_cmd} "{title}" "{message[:1500]}"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            print(f"✓ 通知已发送")
            return True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script unconditionally deletes files from the downloads directory with rm -f when their hash already exists in the database. Although the action is logged, there is no prior user disclosure or confirmation in the script comments indicating that duplicate downloaded PDFs will be removed automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language text in Chinese in the module docstring, and later emits Chinese-only status and error messages. The policy forbids forcing a specific language or locale unless the skill offers user choice or clearly documents a justified locale restriction, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The function returns and prints Chinese-only messages such as extraction errors, progress, and completion notices. Because the file provides no language selection, fallback, or justification for a Chinese-only interface, this appears to violate the language/locale policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs on-disk file renaming, which is a destructive side effect not clearly reflected in the higher-level skill description that focuses on indexing, search, and metadata extraction. In an agent setting, this mismatch can cause unintended modification of a user's document library if the rename command is invoked without the user understanding that files will be moved/renamed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code calls os.rename on user PDF files without any confirmation, approval gate, or rollback support. If metadata extraction is inaccurate or filenames collide unexpectedly, the user's files can be renamed in confusing ways, disrupting downstream workflows, citations, sync tools, or external references.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation description is broad and trigger-based, covering general tasks like managing PDFs, indexing, searching, and metadata extraction without clear scoping or invocation boundaries. In an agent environment, this can cause over-activation on loosely related user requests, leading the skill to access local files or process documents when the user did not explicitly intend to invoke it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as operating in that language, but it does not state that the skill is China-specific or offer any language choice. This can violate language/locale policy when users have not opted into Chinese output or a Chinese-only experience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The config includes a natural-language trigger/value of "科研通" under download keywords, which implies behavior tailored to a specific language/locale. There is no accompanying indication in this file that users can choose locale-specific keywords or that the restriction is documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

PyMuPDF is specified with a lower-bound only constraint, which permits installation of any newer release, including potentially breaking or vulnerable versions. In a document-processing skill that handles PDFs, dependency drift increases supply-chain risk and makes builds non-reproducible, especially because PDF parsers are historically security-sensitive.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Paper Management System Dependencies

# PDF processing
PyMuPDF>=1.23.0

# AI summarization (optional)
openai>=1.0.0

Unverifiable Dependency: PyMuPDF has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

PyMuPDF has known advisories, and because the manifest does not pin a version, it is impossible to determine whether deployments will pull an affected release. This is more dangerous in this skill because it explicitly processes PDFs, making a vulnerable parser or related utility more likely to be reachable.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The openai package is not pinned to an exact version, so future installs may resolve to materially different code than was tested. This creates supply-chain and stability risk, though the direct security impact in this manifest alone is limited because no exploit path is shown here.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

PyMuPDF>=1.23.0

# AI summarization (optional)
openai>=1.0.0
anthropic>=0.20.0

# Configuration

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The anthropic dependency is unpinned, allowing uncontrolled upgrades to versions that may introduce vulnerabilities or unsafe behavior changes. Because this package may interact with local files or tool ecosystems in agent contexts, lack of version control is more concerning than for a purely isolated library.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text

# AI summarization (optional)
openai>=1.0.0
anthropic>=0.20.0

# Configuration
pyyaml>=6.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The anthropic SDK has listed advisories, and without version pinning the deployed package may silently fall into an affected range. In an agent-oriented environment, SDK flaws involving filesystem permissions or path validation can have outsized impact if local tool or file access is enabled.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyYAML has a history of unsafe deserialization issues, and specifying only a minimum version means installations may vary in ways that are hard to audit. In a system that may load configuration from YAML, dependency ambiguity increases the chance of deploying an affected or behaviorally unsafe release.

Content

Scanner excerpt · requirements.txt (reported line 11)May include surrounding context.

text

anthropic>=0.20.0

# Configuration
pyyaml>=6.0

# Development
pytest>=7.0.0

Static analysis

No suspicious patterns detected.