arXiv 论文推荐器

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 1.1.0

Overview

This skill does what it says: it searches arXiv/GitHub for Agent/RAG papers and saves local recommendation reports, with some disclosed but worth-noting privacy and content-integrity risks.

Install only if you are comfortable with the skill making public arXiv/GitHub network requests and saving recommendation reports plus a history file under ~/papers. Treat generated reports as untrusted research content, especially links and abstract text, because arXiv metadata is fetched over HTTP and inserted into Markdown without sanitization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.py:33

Finding

Plaintext arXiv API Retrieval Enables Metadata Tampering and Indirect Prompt Injection

Content

View full analysis

**一句话摘要**：{analysis.get('one_line_summary', '待分析')} ## 📊 基本信息 | 项目 | 内容 | |------|------| | arXiv ID | {paper['id']} | | 发布日期 | {paper['published']} | | 作者 | {', '.join(paper['authors'][:3])}{'...' if len(paper['authors']) > 3 else ''} | | 主题 | {paper.get('topic', '未知')} | | 🔗 arXiv | [{paper['link']}]({paper['link']}) | | 📥 PDF | [{paper['pdf_link']}]({paper['pdf_link']}) | | 💻 GitHub | [{github_url}]({github_url}) (⭐ {stars} stars) | --- ## 📝 摘要 {paper['summary'][:600]}{'...' if len(paper['summary']) > 600 else ''} ``` ### Technical Analysis The search operation sends its arXiv API requ ...[truncated 2781 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search.py:36

Finding

Unbounded Remote Response Read Can Cause Excessive Memory Consumption

Content

View full analysis

list: """解析 arXiv API 响应""" root = ET.fromstring(xml_data) ``` ### Technical Analysis Calling `response.read()` without a size argument reads the entire remote response into memory. The resulting byte string is then parsed as a complete XML document, which can require additional memory. The 30-second timeout limits individual blocking operations but does not establish a maximum response size. A compromised endpoint or network attacker capable of manipulating the plaintext HTTP response can return an unexpectedly large body. This can consume substantial process memory and potentially terminate or destabilize the recommendation process. ### Attack Path 1. A user starts the recommendation workflow. 2. The script opens the plaintext arXiv API URL. 3. A compromised endpoint or suitably positioned network attacker returns a very large response body. 4. `response.read()` attempts to buffer the entire body in memory. 5. `ET.fromstring()` creates further parsing and object-allocation overhead. 6. The process may become slow, be terminated by the operating system, or affect other workloads on a memory-constrained host. ### Impact Assessment This issue affects availability only. It does not provide direct access to local data, operating-system privileges, or code execution. The likely scope is the current Python process, although severe memory pressure could affect other processes running under the same host or container resource boundary. Exploitability is increased by the plaintext HTTP transport identified in the preceding finding. ]]>

Remediation

View remediation

MAX_RESPONSE_BYTES: raise ValueError("arXiv response exceeds the permitted size") chunks = [] total = 0 while True: chunk = response.read(64 * 1024) if not chunk: break total += len(chunk) if total > MAX_RESPONSE_BYTES: raise ValueError("arXiv response exceeds the permitted size") chunks.append(chunk) xml_data = b"".join(chunks) ``` 4. Catch XML parsing exceptions and fail closed with a controlled error. 5. Combine the response limit with HTTPS, content-type validation, schema checks, and limits on the number and length of parsed entries. 6. If larger feeds must be supported, use a streaming XML parser and discard processed elements to keep memory usage bounded. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明的核心能力是“推荐论文”，并强调 Agent/RAG 相关主题覆盖以及“自动验证 GitHub 代码”。但代码中仅包含对输入论文标题和摘要的文本分析逻辑，没有任何检索、排序、推荐、ArXiv 查询、主题过滤、GitHub 访问/校验或外部资源调用能力。其主用途是对已给定的单篇论文摘要生成结构化解读报告，这与“推荐高质量 Agent/RAG 论文”的主要目的存在实质性偏差。生成结构化报告这一点部分吻合，但不足以覆盖声明中的主要功能，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to run local scripts, access the network, read generated reports, and write files/history, but it declares no explicit tool scope or permissions. This weakens sandboxing and review, making it easier for the skill to access more capabilities than users or operators would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses broad, common-language triggers such as requests for paper recommendations, which can cause the agent to invoke networked search and local file-writing behavior in contexts where the user did not intend this specific skill. Overbroad activation increases the chance of unintended data processing, external requests, and execution of local scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples remain broad and lack boundary conditions, so ordinary phrases like 'find a paper' may activate the skill even when the user only wants general advice. In this skill, misfires are more sensitive because activation can lead to network access, GitHub lookups, and persistent local writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill stores reports and a recommendation history on disk, including previously recommended papers and dates, but does not clearly surface this persistence as a privacy-relevant behavior in the main description. Undisclosed local storage can surprise users and may retain preference/history data longer than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring and all user-facing summaries are written in Chinese, and later functions generate fixed Chinese output strings. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated summary and fallback report text are always emitted in Chinese, regardless of input language or user preference. This is a natural-language locale policy issue because the skill does not provide opt-in, selection, or justification for the forced language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language instructions and output strings that assume Chinese as the only language, beginning with the module docstring and continuing throughout the script. Under the language/locale policy, forcing a specific language without user opt-in is a policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script persistently writes recommendation history and full Markdown reports into fixed locations under the user's home directory. Even though this is not remote code execution, it creates undisclosed local data persistence and may store sensitive reading interests, fetched content, and links without explicit user consent, which is a security/privacy concern for an agent skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code writes history and generated reports to the user's home directory automatically, without any explicit warning or confirmation at the point of use. In the context of an agent skill, silent local writes are more dangerous because users may assume the action is ephemeral while the skill actually creates durable artifacts that can expose interests, prompts, and retrieved content to other local users or future processes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains user-facing natural-language descriptions and runtime messages in Chinese, which implicitly forces a specific language experience. The policy allows locale constraints only when user choice or a justified region-specific scope is documented, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 153)May include surrounding context.

python

return None
    
    owner, repo = match.groups()
    api_url = f"https://api.github.com/repos/{owner}/{repo}"
    
    try:
        req = urllib.request.Request(api_url, headers={

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L003 以及整份说明均以中文固定描述触发和输出方式，没有说明是否支持用户选择其他语言或根据用户偏好切换。若组织要求语言/区域中立或需用户选择语言，这种默认强制中文的行为可能构成语言策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.