Security audit

Ai Paper Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only academic paper workflow skill with broad but disclosed research, coding, environment, API, and git guidance that fits its stated purpose.

Install this only for an academic paper/research project. Use a dedicated repo, virtual environment or container, approve API calls, package installs, coding-tool invocations, and git commits explicitly, and redact all secrets from PROGRESS.md and commits.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells the agent to use configured API credentials and external services, expanding scope from local paper-project file generation into networked actions that may incur cost, exfiltrate data, or interact with third-party systems without clear user confirmation. In an agent setting, exposing environment-backed credentials to a broad workflow prompt is dangerous because later steps can repurpose those secrets for unintended calls beyond literature search or writing support.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The prompt authorizes package installation, virtual environments, Docker, and Git operations, which materially increases the agent's ability to modify the host environment and repository state. Even if intended for reproducible experiments, these instructions can lead to unsafe system changes, supply-chain exposure, or accidental persistence of harmful artifacts when executed autonomously.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Directing the agent to invoke external coding tools such as Claude Code and GitHub Copilot CLI delegates execution and code generation authority to additional systems that may access files, credentials, or network resources. This compounds risk because the primary agent loses tight control over what commands or code are produced, while the skill does not define strong boundaries or approval checkpoints.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt references API keys and environment variables as operational inputs without warning about credential handling, privacy, or billing implications. In practice this normalizes secret consumption by the agent and increases the chance that credentials will be used, echoed, or propagated into logs and artifacts during a complex multi-stage workflow.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The skill description is broad enough to match many generic project-organization requests, which can cause the skill to trigger outside its intended scope. Over-broad activation increases the chance the agent will perform file-creation or workflow-shaping actions in unrelated contexts, especially because the skill also recommends workspace modifications.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow instructs the agent to package or commit changes after edits, but it provides no requirement for explicit user approval, preview, or warning. In an agent setting, automatic commits can persist unwanted changes, capture sensitive material, or alter repository history in ways the user did not authorize.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to record environment configuration details including configured environment variables in project artifacts such as PROGRESS.md. This creates a concrete path for secret leakage into files, version control, or shared paper repositories, turning transient credentials into persistent exposure.

Static analysis

No suspicious patterns detected.