hugging-face daily papers

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This skill fetches Hugging Face daily paper metadata and writes a local digest input file; the network, token, and file-write behavior are disclosed and fit the stated purpose.

Install only if you are comfortable providing a Hugging Face read token to the script and having it create or overwrite hf_results.json in the script working directory. Use a minimally scoped read token, avoid broad personal tokens when possible, and be aware that the default output format includes author branding unless you override it in your prompt.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:70

Finding

Mandatory Unrequested Branding in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70-84
Vulnerability Type: Output instruction manipulation
Risk Level: Low

Complete Code Snippet

markdown

## Step 4: Output format

📄 HF Daily Papers · [date] N papers total

🔴 Must Read (score 8-10)

[Title | ID | Organization Xiaolongxia comment: ...]

🟡 Worth Noting (score 6-7)

[Compact list + one-line evaluation]

🟢 Skim If Interested

[Ultra brief list]

🦞 Summary

Top 3 + today's main theme observations

text

Commentary guidelines:
- Every "Must Read" paper needs a "Xiaolongxia comment" — explain the core insight in your own words

Technical Analysis

The Skill requires the agent to insert the branded phrase "Xiaolongxia comment" and lobster-themed presentation into every qualifying digest. This presentation requirement is unrelated to the core privileges needed to retrieve, score, and summarize Hugging Face papers.

Because these instructions are automatically loaded when the Skill is activated, they alter the agent's generated response without requiring an explicit branding request from the user. This is a limited form of instruction hijacking focused on output presentation. It does not modify safety constraints, execute code, access additional data, or establish persistence.

Equivalent instructions also appear in the localized documentation at SKILL_zh.md:70-84, demonstrating that the branding requirement is intentional and consistently imposed.

Attack Path

1. A user requests a Hugging Face Daily Papers digest.
2. The agent activates the Skill and loads SKILL.md.
3. The mandatory output instructions require branded commentary for every paper categorized as “Must Read.”
4. The agent includes the unrequested "Xiaolongxia comment" label and lobster-themed headings in its response.
5. The resulting output promotes the embedded branding despite it not being necessary for the requ ...[truncated 793 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace "Xiaolongxia comment" with a neutral heading such as "Commentary" or "Analysis".
2. Replace the mandatory lobster-themed summary heading with a neutral "Summary" heading.
3. Treat stylistic branding as optional and apply it only when explicitly requested by the user.
4. Update the equivalent instructions in SKILL_zh.md so that both documentation variants use the same neutral behavior.
5. Preserve user control by stating that the proposed format is a default template that may be overridden by the user's requested tone, labels, or structure.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tainted flow: 'HEADERS' from os.environ.get (line 26, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/hf_papers.py (reported line 38)May include surrounding context.

python

print("[1/2] Fetching HF Daily Papers list...")
try:
    resp = requests.get(list_url, headers=HEADERS, params=params, timeout=30)
    resp.raise_for_status()
    papers_list = resp.json()
except Exception as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest promises a user-facing digest workflow, but the documented behavior is a data-export script that fetches content for an arbitrary date and writes JSON locally. This mismatch is dangerous because users, orchestrators, or policy engines may authorize the skill based on the benign summary-report description while it actually performs lower-level network and file operations not obvious from the declared behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs the agent to use environment variables, write files, and access the network, but the manifest does not declare any tool or permission scope. That creates an authorization gap: a host may allow broader-than-intended capabilities or fail to present clear consent boundaries to users and reviewers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match many generic requests for summaries, reports, or today's papers, which can cause the skill to activate unexpectedly. Over-broad invocation increases the chance of unintended network calls and file creation in contexts where the user only wanted a normal conversational summary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest uses very broad trigger phrases such as 'daily paper' and 'huggingface papers' that can match ordinary user requests and cause the skill to activate more often than intended. Over-broad routing is dangerous because it can invoke network-fetching behavior and downstream analysis on ambiguous prompts, increasing the chance of unintended external data access or surprising execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown explains how to run the script and notes the output file name and location, but it does not present this as a user-facing warning about local file creation. Since the skill causes a filesystem write, the description should explicitly disclose that behavior so users understand it will create or overwrite local data in the working directory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill reads a bearer token from the environment even though its stated purpose is to fetch public daily papers, which appears unnecessary. Unneeded secret handling increases attack surface: it conditions operators to provide credentials, and any future code change, logging bug, or dependency issue could expose a token that did not need to be present at all.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest frames the skill as fetching papers and generating a digest/report, but this standalone script persists raw results to hf_results.json as a local artifact. That file-writing behavior is not reflected in the description and goes beyond a purely fetch-and-digest operation as stated.

Content

No source excerpt is available for this finding.