Security audit

Paper Polisher Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local paper-analysis tool, but it under-discloses remote web-note editing and PDF-generation behavior while also encouraging AI-detection evasion.

Install only if you are comfortable with a skill that can guide local paper analysis and rewriting, and review any agent action carefully before allowing web-note edits or PDF generation. Do not rely on the 'zero upload' claim for sensitive drafts unless you disable or avoid the 归墟/web-note workflow, and require a diff plus explicit target-note confirmation before any PUT update.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill documentation advertises executable capabilities including file read, file write, and shell usage, but no explicit permissions model is declared. That mismatch weakens trust boundaries and can lead to accidental overreach or unsafe execution in hosts that rely on manifest permissions for policy enforcement.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill claims to be fully local with zero upload, yet later instructs the agent to fetch and update remote notes over HTTP and generate PDFs from remotely sourced content. This discrepancy can cause unauthorized data transfer and source-of-truth modification, especially if users trust the local-only claim when handling sensitive academic drafts.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The documented workflow expands from local text analysis into remote content synchronization and PDF production, increasing capabilities beyond what users would reasonably expect from a one-command paper-polishing tool. Scope creep like this is dangerous because it introduces network access, stateful remote modification, and shell-based document rendering under an innocuous description.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill instructs editing a remote web note via API, which is a write operation against an external service unrelated to the minimally necessary behavior of local paper polishing. If invoked automatically or without clear consent, this can overwrite source material, create version conflicts, and alter user data in a remote system.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation prominently claims '100% Local · Zero Upload' while later sections require HTTP API reads and writes to a web-hosted note system. This is a material security misrepresentation that can cause users to expose confidential documents under the false assumption that no network transmission occurs.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The document is scoped as a PDF-generation pipeline, but it also includes authenticated note-modification guidance for the internal Hub PUT API, including version-handling semantics. In a skill context, this expands capability from read/render operations into write operations against an internal service, increasing the risk of unintended or unauthorized content alteration if reused by an agent.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The workflow directs the use of subprocess-invoked curl and a headless Chrome pipeline against local/internal resources. In an agent skill, this creates a path for network access and local command execution primitives that can be repurposed beyond document polishing, especially when combined with untrusted note content and permissive browser flags like --no-sandbox.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow describes modifying a remote web note but does not present a strong, explicit warning that the source content will be changed. Lack of a clear modification warning increases the chance of unintended data alteration, especially when users believe they are only requesting analysis or polishing.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad phrases such as 论文润色, 改写论文, 学术写作助手, and 手稿润色 that can appear in many benign contexts. This can cause unintended invocation of a skill that performs AI-detection, rewriting, and de-AI transformations on academic text, creating surprise execution and increased risk of inappropriate content modification.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow describes detecting AI authorship, rewriting text to reduce AI signals, and generating reports, but it does not prominently warn about false positives, academic-integrity risks, or the possibility that automated rewriting may alter tone or meaning despite stated constraints. In an academic-paper context, this can mislead users into using the tool for evasion or submitting modified content without understanding compliance and authorship consequences.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The workflow includes a hardcoded Chinese prompt example ("Don't make the user ask '进度?'"), which assumes Chinese-language interaction without confirming the user's preferred language. In a bilingual skill this can cause confusing or inappropriate responses, reduce usability, and in some contexts lead to unintended disclosure or miscommunication if the agent switches languages unexpectedly.

Natural-Language Policy Violations

High

Confidence: 86% confidence
Finding: The description explicitly advertises fingerprinting of 'Chinese LLMs', which introduces locale- or model-origin-specific profiling without any visible justification, opt-in, or explanation of scope in this file. In a writing-analysis skill, this can enable discriminatory treatment, opaque user targeting, or overcollection/inference about text origin beyond what users reasonably expect.

Ssd 4

Medium

Confidence: 93% confidence
Finding: The workflow explicitly guides users in rewriting text to reduce or evade AI-detection signals while preserving meaning. That is an evasion-use capability that can facilitate academic dishonesty, policy circumvention, and deceptive submission of AI-generated work as human-authored.

Ssd 2

Medium

Confidence: 91% confidence
Finding: Trigger phrases such as 'deai', 'humanize', and 'remove AI traces' clearly frame the skill as a means to bypass AI-detection systems. That intent increases misuse risk by making the skill easy to discover for users seeking to conceal AI-generated academic writing.

Ssd 2

Medium

Confidence: 90% confidence
Finding: The documentation discusses AI-paraphrased drafts that dodge blacklists and recommends rewriting tactics to vary rhythm and punctuation so flagged paragraphs can pass re-analysis. This directly supports iterative evasion of detection heuristics rather than legitimate proofreading alone.

Static analysis

No suspicious patterns detected.