nature-paper-workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 2.0.0

Overview

The router itself is mostly disclosed and read-only, but it directs users to install optional third-party sub-skills from an unpinned GitHub repository that can change after review.

Install only after reviewing the referenced sub-skills yourself. Prefer a pinned commit or release for the Econ extension, verify file contents before copying anything into ~/.claude/skills, and confirm the router's branch, venue, and language choices on ambiguous academic requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/discipline-routing.md:162

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: references/discipline-routing.md, lines 162–170
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

text

- Check whether `~/.claude/skills/econ-write/SKILL.md` exists
- If it does not exist, prompt the user:

⚠️ The economics branch requires the econ-* extension package (five sub-skills)

Installation command: git clone https://github.com/juliaError/econ-TopJournal-writing-Skill.git

Then copy the five subdirectories under skills/ into ~/.claude/skills/

Note: The econ-* extension package uses the CC BY-NC 4.0 license

text

The same mutable repository is declared as an optional dependency in manifest.yaml, lines 359–370, and plugin.json, lines 29–41.

Technical Analysis

The installation procedure clones the mutable default branch of a third-party GitHub repository. It does not pin a reviewed commit or immutable release and does not require checksum, signature, provenance, or content verification.

This is security-sensitive because the downloaded sub-skills are copied into ~/.claude/skills/. The router subsequently reads those sub-skills' SKILL.md files and allows their instructions to control task execution. Therefore, the effective instructions executed by the agent can change after this router package has been reviewed.

The project does not automatically run the command, and the reviewed repository contains no malicious payload. The risk arises from the documented supply-chain process and the trust placed in mutable external skill content.

Attack Path

1. An attacker compromises the referenced GitHub account or gains the ability to alter the upstream repository.
2. The attacker adds malicious or unsafe instructions to one or more sub-skill files on the default branch.
3. A user requests an economics workflow while the optional extension is not installed.
4. The router presents the unpinned `git ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed commit hash or immutable signed release rather than cloning the mutable default branch.
2. Publish an allowlisted commit identifier and SHA-256 checksums for every installed skill file.
3. Require checksum and signature verification before copying files into ~/.claude/skills/.
4. Add a mandatory review step that inspects each downloaded SKILL.md, manifest, script, and referenced resource before activation.
5. Document the exact source and destination paths instead of broadly instructing users to copy multiple directories.
6. Apply least privilege when loading third-party skills, especially for subprocess, network, credential, and unrestricted file-system access.
7. Re-audit the extension package whenever the pinned version changes.
8. Consider distributing the optional dependency through a controlled, versioned registry with provenance attestations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (26)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

读取目标子 skill 的 `SKILL.md`，让它的路由协议主导执行。具体调用方式见 [references/sub-skill-protocol.md](references/sub-skill-protocol.md)。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad phrases like '帮我写论文', '帮我投稿', and general economics terms, which can match routine academic requests and invoke this router when a narrower or more appropriate skill was intended. Although the router is read-only and does not execute high-risk actions itself, misrouting can still steer users into an unintended workflow, increasing the chance of inappropriate downstream skill activation or incorrect assumptions about task scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill applies defaults such as '默认期刊导向' and '未明确 venue 时按 Nature 系列处理' without explicit user consent. In a routing skill, these assumptions can bias task selection and downstream recommendations toward a prestigious journal track or language/discipline-specific path that the user did not request, potentially causing wasted effort, unsuitable advice, or accidental disclosure of intent in later stages.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very generic phrases such as literature review, 找文献, 综述, and 论文下载, which can match many ordinary research-assistance requests without strong phase disambiguation. In a top-level router, overly broad triggers can cause unintended activation and misroute user requests to downstream skills, expanding the effective authority surface and bypassing more appropriate routing logic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Writing-stage triggers like 起草, 写摘要, 写引言, 写方法, 写讨论, 写结论, 投稿包, and cover letter are generic authoring intents that also appear in the econ branch, but the manifest relies on later discipline routing rather than constraining them at the trigger level. This creates ambiguous matches at the router layer and increases the chance of sending users to the wrong branch or activating a writing workflow when the request is only editorial or exploratory.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The econ workflow reuses the same broad drafting triggers used elsewhere, including generic phrases for writing abstract, introduction, methods, discussion, conclusions, and cover letters, without negative examples or exclusivity constraints. Because this router is meant to dispatch only, duplicate broad triggers increase accidental branch selection and can invoke optional external-package functionality under weak evidence of user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Review and revision triggers such as 审稿模拟, 预审, 审稿意见, 返修, rebuttal, response, and 逐点回复 are common editorial phrases that can arise in many contexts and are shared across disciplines. In a centralized router, this can cause cross-branch collisions and unintentional delegation to reviewer/rebuttal skills, especially when combined with shared sub-skills reused by both STEM and econ branches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest context says this skill should only identify the paper-workflow stage and route to sub-skills, without executing paper tasks itself. However, the description and dependency list present it as an end-to-end workflow skill spanning writing, polishing, figure work, review, response, citation, submission audit, and economics-writing branches, which materially exceeds a narrow router-only role at the manifest level.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The provided skill-manifest context says the skill 'does NOT execute paper tasks; it routes to sub-skills' and is limited to reading sub-skill SKILL.md files. In contrast, the plugin description says it is a '多学科端到端论文工作流顶层路由 skill' that supports full STEM and economics branches, which semantically implies a broader operational role than simple routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

该文件整体使用中文描述路由规则、安装提示和操作说明，未见提供其他语言选项或说明仅面向中文用户。按规则，若技能在自然语言层面强制特定语言而没有用户 opt-in，属于语言/locale 政策风险。

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 83% confidence

Finding

The skill instructs the agent to check whether ~/.claude/skills/econ-write/SKILL.md exists, which reveals information about the local skill installation state. In a routing skill, this creates a small but real environment-enumeration channel: an attacker could infer installed capabilities or tailor follow-on prompts based on whether the econ extension is present.

Content

Scanner excerpt · references/discipline-routing.md (reported line 162)May include surrounding context.

• 无需额外校验，35 个 STEM 子技能已安装即可

Econ 模式

• 检查 ~/.claude/skills/econ-write/SKILL.md 是否存在
• 不存在时提示用户：

  text

  ⚠️ 经济学分支需要 econ-* 扩展包（5 个子技能）
  

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The E-1 trigger list contains broad phrases such as '起草', '写摘要', '写引言', '写方法', and 'cover letter' that are common academic writing requests and not unique to this econ workflow. In a top-level router skill, such generic triggers can cause unintended invocation, misroute users away from more appropriate skills, and expand the skill's effective scope beyond its stated routing purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The E-5 trigger list includes generic phrases like '审稿意见', '返修', 'response', and '逐点回复', which are common across many academic and editorial contexts. Because this file defines routing behavior, these broad triggers may collide with unrelated review/help requests and incorrectly invoke the economics review/revision path, causing confusion and unintended handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger keywords in this section include broad, everyday requests such as reading papers, finding literature, writing reviews, or deriving conclusions. In a top-level router, overly generic triggers can cause unintended skill activation and misroute users into specialized workflows they did not explicitly request, which increases the chance of inappropriate downstream behavior or policy bypass through ambiguous phrasing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Multiple writing-oriented skills are triggered by vague terms like writing abstracts, introductions, or submission packages without clear boundaries between them. This ambiguity is risky in a router because similar user prompts may invoke the wrong drafting or revision skill, leading to workflow confusion, unintended capability exposure, or inconsistent safety constraints across sub-skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Econ branch includes generic triggers such as drafting, introductions, economics papers, and complex projects, which are broad enough to overlap heavily with other branches and normal conversation. In this router-only skill, that can produce incorrect branch selection and unintentional invocation of econ-specific pipelines, especially when users mention common academic tasks without clearly signaling economics context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file title and all operational instructions are written only in Chinese, which imposes a specific language on users and downstream agents. The policy allows language constraints only when the skill offers a language choice or clearly documents a justified locale restriction, neither of which is stated here.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sub-skill-protocol.md (reported line 59)May include surrounding context.

md

Router: 📍 学科分支：STEM
        📍 当前阶段：Phase 0a - 读论文
        🎯 路由到：nature-reader
[读取 ~/.claude/skills/nature-reader/SKILL.md]
[按 source_format=pdf-text 加载 static/ 片段]
[执行 reader 流程]
Router: ✅ 完成

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sub-skill-protocol.md (reported line 73)May include surrounding context.

md

Router: 📍 学科分支：STEM
        📍 当前阶段：Phase 2a - 章节起草
        🎯 路由到：nature-writing
[读取 ~/.claude/skills/nature-writing/SKILL.md]
[按 task=drafting, section=introduction 加载 static/ 片段]
[执行写作流程]
Router: ✅ 完成

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sub-skill-protocol.md (reported line 100)May include surrounding context.

md

User: 帮我核验引用
Router: 📍 跨学科共享：引用核验
        🎯 路由到：nature-ref-verifier（共享）
[读取 ~/.claude/skills/nature-ref-verifier/SKILL.md]
[执行引用核验流程，与学科无关]
Router: ✅ 完成
        👉 下一步：如需 BibTeX 格式核验，追加 citation-verifier

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sub-skill-protocol.md (reported line 113)May include surrounding context.

md

Router: 📍 学科分支：Econ
        📍 当前阶段：E-5a - 审稿模拟
        🎯 路由到：nature-reviewer（共享，按经济学视角调整）
[读取 ~/.claude/skills/nature-reviewer/SKILL.md]
[按经济学视角调整审稿维度：Identification Quality / Data Quality / Robustness Coverage / Mechanism Credibility / Contribution Significance / Policy Implication]
[执行审稿模拟，生成 3 份 reviewer reports]
Router: ✅ 完成

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/sub-skill-protocol.md (reported line 129)May include surrounding context.

md

共享子技能（`paper-bootstrap` / `nature-ref-verifier` / `citation-verifier` / `submission-audit` / `nature-reviewer` / `nature-response`）两个分支都可调用，无需切换分支。

### Econ 分支可用性校验
进入 Econ 分支前，检查 `~/.claude/skills/econ-write/SKILL.md` 是否存在。不存在时提示用户安装 econ-* 扩展包。

### 分支切换
用户中途转向不同学科任务时，重新走 Pre-Phase 学科识别，不混合两个分支的工作流。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The STEM trigger table includes generic phrases such as 写摘要、写引言、写方法、写讨论、cover letter, which are common across many normal writing requests and can cause unintended routing to specialized sub-skills. In a router skill, overbroad matching is a real security and safety issue because it can steer users into the wrong workflow without clear confirmation, increasing the chance of inappropriate downstream behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Econ full-drafting triggers include highly generic terms like 起草、写摘要、写引言、写方法、写讨论、写结论, which are not uniquely tied to economics and can easily match unrelated user prompts. Because this file is a top-level routing map, accidental activation can misclassify user intent and invoke economics-specific sub-skills when the user did not request them.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The E-phase routing hard-codes output selection by language for economics writing, directing users to different sub-skills based on 中/英 without an explicit opt-in or confirmation of preference. This can override user intent, create inappropriate routing for bilingual or mixed-language requests, and reduce transparency in how the agent decides which writing workflow to use.

Content

No source excerpt is available for this finding.