论文格式排版

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 2:09 AM UTC
• Version: 1.0.0

Overview

This is a disclosed local paper-formatting skill; users should confirm Chinese/GB defaults and any auto-filled thesis cover date before relying on it.

Install only if you want a Chinese/English academic paper-formatting workflow that can locally read and rewrite supplied Word or LaTeX sources. Review output before submission, provide official templates when available, and explicitly confirm or override any missing thesis cover date instead of relying on the default current-date behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad paper-formatting skill for Word and LaTeX source documents, including structural formatting tasks across multiple paper types. The supplied code instead implements a specific validation check: detecting explicit non-black text colors in a DOCX document and in used styles. This is a materially different primary purpose. While checking text color could be a small supporting utility within a larger formatting pipeline, this code chunk by itself does not format papers, does not handle the declared range of input types, and does not implement the described document-processing capabilities. Therefore the description does not accurately represent this code chunk's actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a comprehensive paper-formatting capability across Word and LaTeX sources, including validated LaTeX projects and multiple paper types. The supplied code does something materially narrower and different: it inspects a single DOCX document's body paragraphs for justification and first-line indentation, using heading heuristics to locate the main body, and emits a validation report. This is not merely an implementation detail of a formatter; it is a distinct primary purpose (style checking rather than document formatting) and omits most declared file types and formatting functions. Therefore the description does not accurately represent the behavior of this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear description-behavior mismatch. The declared purpose presents a broad document-formatting skill for multiple paper types and source formats, including Word and LaTeX, with handling of abstracts, TOC, headers/footers, figures, equations, and references. The supplied code does none of that formatting work. Instead, it only reads a DOCX package and validates a specific cover layout convention: required labels such as 姓名/专业/学校, no tables on the cover, centered paragraphs, SimSun 14pt styling, underline presence, and date placement in a centered footer with proper section separation. This is a specialized lint/check script, not a formatter, and it does not support the declared LaTeX or broader document-processing scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose describes a comprehensive manuscript normalization/formatting skill across Word and LaTeX sources. The supplied code instead implements a very specific audit for front-matter page boundaries inside a DOCX document.xml file. This is materially narrower and different from the declared primary purpose: it neither formats documents nor supports the advertised input types beyond DOCX. While checking abstracts and TOC is related to thesis formatting, this chunk’s actual behavior is a specialized validator, not the described end-to-end formatting capability. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个广义论文格式化技能，核心能力应是对整篇论文进行版式规范化，并覆盖 Word 与 LaTeX 多种源格式。代码却只是针对 DOCX 中已存在的参考文献列表做有限的规则检查，尤其集中在 GB/T 7714—2025 文献著录形式，输出错误与警告，不生成或调整整篇论文格式。这不是简单的实现细节差异，而是主要目的、支持文件类型、处理范围和能力边界都明显不一致，因此属于实质性描述—行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full paper-formatting capability across Word and LaTeX inputs, with template-aware handling of many thesis/journal formatting elements. The supplied code does not implement formatting at all. Instead, it performs a specific structural check on DOCX heading numbering by parsing WordprocessingML XML inside a .docx ZIP container. This is materially narrower and different in primary purpose. While heading checks could be a supporting subcomponent of a formatter, this code chunk by itself only validates one aspect of heading numbering and lacks the advertised document-type support and formatting behaviors. Therefore the description does not accurately represent the actual code behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: There is a material description-behavior mismatch. The declared purpose presents a comprehensive paper formatting capability across Word and LaTeX inputs, with support for multiple paper types and many formatting components. The supplied code instead performs a single audit task: checking whether paragraphs in certain named Word styles have 1.5 line spacing. It does not format content, does not touch LaTeX, does not process ZIP projects, and does not implement the broader document-structure handling described. While line-spacing validation could be a supporting subcomponent of a formatter, this code chunk's actual behavior is much narrower than the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear material mismatch. The description presents a comprehensive academic paper formatting skill for Word and LaTeX sources, but the code performs a very specific inspection task: checking page-number field presence and visible numeric results inside Word footer XML. It neither reformats documents nor handles LaTeX, .doc files, or general thesis/journal structure. This is not merely an implementation detail of a formatter; it is an entirely different primary function with much narrower file support and behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a broad paper-formatting capability across Word and LaTeX inputs, including multiple paper types and many formatting components. The supplied code does something much narrower and materially different: it checks page-numbering configuration in DOCX body sections. This is not merely an implementation detail of a formatter; it is a standalone validator for one specific formatting rule. It also lacks the declared multi-format support, especially LaTeX handling and .doc support. Therefore the code chunk does not accurately represent the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a clear description-behavior mismatch. The declared purpose describes a full paper-formatting capability across multiple source formats and paper types. The supplied code instead performs a single static check on paragraph spacing values inside a DOCX XML document and emits a machine-readable validation result. While such a check could be a supporting subcomponent of a formatting pipeline, on its own it does not implement or substantiate the broad declared functionality. The code also handles only DOCX-like ZIP packages and not the other declared input types or formatting operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a clear description-behavior mismatch. The declared purpose presents a comprehensive paper-formatting skill for Word and LaTeX sources, covering multiple paper types and many formatting components. The actual code does not perform formatting at all. It is a specialized validation script for DOCX TOC layout and leader-tab correctness. While TOC handling is mentioned in the description, this code is only a small auditing subcomponent and its primary purpose is materially narrower and different from the claimed end-user functionality. No suspicious undeclared external access is present, but the implemented capability is significantly more limited than the declared skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a formatting skill for multiple source formats and paper types, with template-priority normalization behavior. The actual code chunk is materially different: it is an acceptance/validation pipeline for a graduation thesis DOCX, invoking checker scripts for content, spacing, TOC, cover, headings, page numbering, page fields, alignment, and GB/T 7714 references. Its primary purpose is to assess whether a DOCX meets structural/layout requirements, not to reformat the paper. It also lacks the declared LaTeX/ZIP support and broader paper-type handling. These are core behavioral differences, not minor implementation details, so this is a clear mismatch.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

args = parser.parse_args()
    target = str(Path(args.docx).resolve())
    folder = Path(__file__).resolve().parent
    child_env = os.environ.copy()
    child_env["PYTHONUTF8"] = "1"
    child_env["PYTHONIOENCODING"] = "utf-8"
    results = []

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to use shell, file read/write, environment manipulation, and conversion/extraction scripts, but it does not declare any explicit tool scope or allowlist. In an agent framework, this weakens least-privilege boundaries and can allow broader-than-necessary execution against untrusted document inputs, especially ZIP archives and office files.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The instruction requires preserving the source language of references and explicitly specifies Chinese and English handling, while the document itself mandates a Chinese reference-formatting workflow. This creates a locale/language constraint without offering the user a choice or opt-in, which matches the policy category for forced language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The document is written as a mandatory default formatting scheme for graduation theses and consistently requires Chinese-specific typography, labels, and formatting conventions such as Chinese headings, Chinese fonts, and Chinese keyword labels. There is no stated user opt-in or language/locale choice, so the skill appears to enforce a specific language/locale policy by default.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document first says missing source fields must not be guessed or fabricated, then creates an exception that silently fabricates the cover date. This contradiction is dangerous because it weakens trust boundaries for missing data handling and makes it easier for the skill to justify inserting invented content into an official thesis cover page.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The guidance explicitly instructs the skill to invent a submission date when the source document does not contain one. In a thesis-formatting context, that changes user-authored document metadata and can introduce a false factual statement into a formal academic document, which is especially risky because dates may have administrative or compliance significance.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The instructions require language-specific behavior such as matching headers to the paper's main language and then prescribe Chinese defaults for正文页眉 and Chinese thesis formatting. Because this markdown does not state that the skill is limited to Chinese-region theses or provide an opt-in language choice, it appears to force a locale-specific policy on users.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata explicitly says plain-text inputs must not be used for formatting, but the document later allows '纯文本到 Word' processing. This inconsistency can cause the agent to accept out-of-scope inputs and bypass the intended input-validation boundary, increasing the chance of misuse, unsupported transformations, or incorrect handling of user data.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's natural-language output strings are entirely in Chinese, including usage, error, and note messages. For a general-purpose code file with no documented regional or locale restriction, this imposes a specific language on users without opt-in, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file hard-codes locale-specific natural-language requirements such as the date pattern `YYYY 年 M 月 D 日` and later checks for Chinese labels like `姓名`, `专业`, and `学校`. This appears to force a specific language/locale behavior in the skill without offering user opt-in or documenting that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script emits usage and error messages only in Chinese, such as the usage text and invalid-file diagnostics. This imposes a specific language on all users without opt-in or documented locale justification, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The JSON result includes a user-visible reason string in Chinese only: "未找到可识别的正文或摘要正文样式，未执行行距断言。" This imposes a specific language on users without opt-in or any indication that the skill is intended only for a Chinese-language environment, which matches the locale-policy concern for natural-language violations.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code returns multiple hard-coded Chinese status and error messages for all user interactions, including usage help and validation results. For a general-purpose input validator, forcing a specific language without opt-in or justification is a natural-language locale policy issue.

Static analysis

No suspicious patterns detected.