Security audit

arxiv-to-beamer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its helper script unsafely handles downloaded archives in ways that could affect local files or resources.

Review before installing or run it only in a contained workspace. It sends paper-derived content to OpenRouter and may send PDF URLs/content through MinerU, reads API tokens from environment variables, and should not be used on untrusted or sensitive papers without sandboxing or archive-safety fixes. Use --no-mineru-fallback to avoid MinerU, and pass --language if Chinese slides are not desired.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/arxiv_to_beamer.py:79
Finding: Unsafe Extraction of Untrusted arXiv Tar Archives
Content: View full analysis
`. 4. `tf.extractall(src_dir)` processes malicious absolute, traversal, or link-based entries without explicit validation. 5. The extraction operation creates or overwrites files outside the temporary source directory using the privileges of the user running the Skill. ### Impact Assessment Successful exploitation may allow an attacker to create or overwrite any file writable by the invoking user. Depending on the target environment, this could affect shell configuration, application configuration, project files, credentials, or files subsequently interpre ...[truncated 280 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv_to_beamer.py:191
Finding: Unrestricted MinerU Result URL Enables Server-Side Request Forgery
Content: View full analysis
tuple[bytes, str]: req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.read(), resp.headers.get("Content-Type", "") ``` ### Technical Analysis The download URL is taken from the MinerU API response and supplied directly to `urllib.request.urlopen()`. The script does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Whether the destination is loopback, private, link-local, or otherwise internal. - Redirect destinations. Although obtaining a result archive from MinerU is part of the declared functionality, arbitrary network access is not necessary. A compromised MinerU response, compromised service account, malicious intermediary capable of influencing the response, or unexpected API behavior could make the Skill request an internal or local resource. If the response is a valid ZIP containing Markdown, its content is read and ...[truncated 1301 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv_to_beamer.py:56
Finding: Unbounded Downloads and Archive Expansion Permit Resource Exhaustion
Content: View full analysis
tuple[bytes, str]: req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.read(), resp.headers.get("Content-Type", "") ``` The arXiv tar archive is extracted without member-count or expanded-size limits: ```python archive.write_bytes(data) extracted = False try: with tarfile.open(archive, "r:*") as tf: tf.extractall(src_dir) extracted = True except tarfile.ReadError: pass ``` The MinerU result is also fully buffered and extracted without resource limits: ```python print(f" downloading MinerU result archive ...", file=sys.stderr) try: zip_bytes, _ = http_get(zip_url, timeout=180) except urllib.error.URLError as e: print(f"MinerU result download failed: {e}", file=sys.stderr) return None extract_dir = work_dir / "mineru_out" extract_dir.mkdir(parents=True, exist_ok=True) zip_path = work_dir / "mineru.zip" zip_path.write_bytes(zip_bytes) try: with zipfile.ZipFile(zip_path) as zf: zf.extractall(extract_dir) except zipfile.BadZipFile: print("MinerU result is not a valid zip", file=sys.stderr) return None ``` ### Technical Analysis The script places no limit on: - HTTP response size. - Archive member count. - Individual extracted-file size. - Total expanded size. - Compression ratio. - Disk space consumed during extraction. The `--max-chars` option only truncates text after files have already been downloaded and extracted. It therefore does not mitigate resource exhaustion during network retrieval or decompression. A ...[truncated 1387 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs network access, reads environment variables, and writes files, but it does not declare any explicit tool scope or permissions boundary. This weakens reviewability and enforcement, making it easier for an operator or agent runtime to invoke the skill with broader capabilities than users would reasonably expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill sends paper content to third-party services (OpenRouter and potentially MinerU), but the description does not clearly disclose this data flow up front. Users may provide unpublished, sensitive, or licensed content without understanding it will be transmitted externally, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Defaulting output language to Chinese without explicit user opt-in can cause unexpected behavior, misleading output, or accidental disclosure when the user expects another language. While not a direct code-execution issue, it is a trust and safety problem because defaults materially shape what gets sent to and generated by the model.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt text in build_prompt is entirely in Chinese and the CLI default --language is set to 中文, which steers output into a specific language/locale by default. This is a natural-language policy issue because the skill imposes a language choice unless the user notices and overrides the flag, rather than explicitly offering neutral opt-in behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.