academic-pipeline-v1

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

This is not malicious code, but it should be reviewed because it handles sensitive academic drafts and session history with unclear consent and inconsistent safeguards.

Install only if you are comfortable with a workflow that may send manuscript details to search/API tools and that can produce detailed process PDFs containing quotes, decisions, and evaluations. Skip or modify the de-AI/humanize and process-summary stages if your institution, journal, or confidentiality obligations require stricter disclosure or privacy controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: This is a true vulnerability because the error-recovery section explicitly allows users to proceed after Stage 4 verification still fails, which directly contradicts the earlier 'mandatory blocking' integrity-gate design. In an academic publication pipeline, that inconsistency can be exploited or accidentally followed to bypass citation, data, or claim verification and move unverified content into review and finalization stages.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill presents itself as a lightweight orchestrator that 'does not perform substantive work,' but later assigns itself artifact generation duties such as creating a process record and PDF outputs. That contradiction weakens trust boundaries: operators or downstream systems may grant the orchestrator broader permissions than intended, and the orchestrator may end up handling document content directly despite the stated separation-of-duties model.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: This is a true vulnerability for the same boundary-confusion reason: the documentation says the orchestrator only dispatches and coordinates, yet Stage 12 assigns it responsibility for generating final process-summary documents. In long multi-agent workflows, inconsistent role definitions can cause the orchestrator to process sensitive manuscript history, reviewer feedback, or integrity-audit data outside the intended agent boundary, increasing the chance of policy bypass or improper handling.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata and the orchestrator file describe materially different workflows: the manifest promises a 12-stage pipeline with mandatory humanization, but the implementation omits that stage entirely. In an agent system, this mismatch can cause unsafe routing, skipped controls, or false user expectations about which safeguards are actually enforced.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The internal stage structure in the file diverges from the advertised pipeline model, creating an inconsistent control flow contract. This is dangerous because other agents, wrappers, or users may rely on the documented stage order for enforcing mandatory checks, and a mismatch can lead to missed steps or incorrect handoffs.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The fallback matrix routes a failed final integrity check back to 'Stage 5 revision,' but Stage 5 is defined elsewhere as finalization, not revision. This inconsistency can break recovery logic after a failed integrity gate and may cause the system to finalize or mishandle a draft that should instead be sent back for substantive revision.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The state machine materially contradicts the skill’s advertised workflow by omitting the promised humanize/de-AI stage and collapsing the described 12-stage process into a much shorter path. In an orchestration skill, this is dangerous because downstream consumers may rely on the documented guarantees for compliance, quality, or disclosure-sensitive processing, yet the actual legal transitions permit completion without those safeguards.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The exception handler explicitly allows the pipeline to continue after exceeding integrity-check retries, even though the skill claims mandatory integrity verification and reproducible quality gates. That creates a policy bypass where unverified or unverifiable content can still progress to later stages, undermining trust, auditability, and any safety guarantees attached to the pipeline.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This file introduces a new post-finalization Stage 6 that extends the advertised academic-paper pipeline into a session-documentation and reporting workflow. Undisclosed workflow expansion is risky because it changes what the skill does with user data and artifacts after the user reasonably expects the process to be complete.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The protocol mandates a 'Collaboration Quality Evaluation' that scores and critiques the user's behavior, which is outside the stated purpose of producing an academic paper. This creates unnecessary profiling of the user and encourages retention and publication of evaluative personal inferences that the user may not expect or want.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The AI self-reflection and failure-mode audit introduce internal behavioral auditing features not disclosed in the skill's academic workflow description. While transparency can be beneficial, silently adding audit/reporting behavior changes the data processing scope and may expose internal logs, model decisions, and user interactions in generated artifacts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The optional cross-model verification instructs the agent to send sampled references to another model/API when an environment variable is enabled, but the skill text provides no explicit user-facing consent, notice, or data-handling boundary. In an academic pipeline, references, manuscript metadata, and unpublished research context may be sensitive; silently transmitting them to a third party can violate confidentiality, contractual restrictions, or privacy expectations.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The example explicitly states that the conversation with the orchestrator is in English without showing any user choice or fallback, which can coerce users into a language they did not select. In an academic workflow, this can degrade comprehension of review guidance, revisions, and consent around later actions, especially for multilingual users who may misunderstand important process details.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Using a broad phrase like "stop here" as a control trigger can cause accidental state changes during normal conversation, especially in a multi-stage interactive workflow. An unintended pause can disrupt sequencing, create inconsistent state restoration, or cause users to believe actions completed when the orchestrator silently saved and halted instead.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The protocol directs the system to generate Markdown and PDF files containing process history and user quotes, but it does not require a clear warning that these are shareable artifacts containing potentially sensitive session content. This materially increases the chance of accidental disclosure when files are saved, exported, or forwarded.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrase "status" is excessively generic and can be invoked during ordinary conversation, creating a significant risk of accidental skill activation or routing conflicts with other skills. In an orchestrator that exposes pipeline state and can respond "at any time," this ambiguity increases the chance of unintended disclosure of research progress or confusion in multi-skill environments.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs the AI to review the session history and compile verbatim user instructions, decision points, corrections, and insights into output files. Preserving and exporting this level of conversational detail creates a clear privacy risk, especially if the session includes confidential research topics, personal details, or proprietary material.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The required sections mandate verbatim user quotes and a chronological record of important decisions, which can reconstruct sensitive parts of the conversation and reveal intent, priorities, and private context. Because the output is designed for sharing, this substantially raises the likelihood of secondary disclosure beyond the original session.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Requiring the report to quote and assess the user's behavior combines disclosure with judgment, increasing sensitivity of the exported content. Even if not overtly malicious, this can expose embarrassing or personal statements and create an unnecessary profiling artifact tied to the user.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.