arxiv-daily

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 0.9.1

Overview

The skill is mostly an arXiv paper fetch-and-digest helper, but it automatically installs unpinned Python packages and has loosely scoped subscription and push instructions that users should review first.

Install only if you are comfortable with a Chinese-language arXiv workflow that writes local config and data files, may be connected to recurring timers and push delivery, and currently auto-installs Python dependencies. Prefer reviewing or editing run.sh to install dependencies manually in a virtual environment with pinned versions before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/run.sh:38

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/run.sh, lines 38-43
Vulnerability Type: Supply-chain exposure through automatic installation of unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

# 检查依赖库
python3 -c "import requests, bs4" 2>/dev/null
if [ $? -ne 0 ]; then
    echo "正在安装必要的依赖库..."
    pip3 install requests beautifulsoup4 -q
fi

Technical Analysis

The launcher automatically invokes pip3 when either required module is unavailable. The packages requests and beautifulsoup4 are installed without fixed versions or verified hashes. Package resolution also relies on the user's ambient pip configuration rather than an explicitly trusted repository.

This makes the executed dependency set mutable after the Skill has been reviewed. A compromised future package release, compromised package index, malicious mirror, or attacker-controlled pip configuration could cause pip to retrieve and install attacker-controlled code. Python packages can execute code during installation through build backends and related packaging mechanisms, and malicious runtime code would subsequently be imported by fetch.py.

The use of a generic pip3 executable instead of python3 -m pip also creates a risk that dependencies are installed into a different interpreter environment or that an unexpected executable found through PATH is invoked.

Attack Path

1. The victim runs scripts/run.sh in an environment where requests or bs4 cannot be imported.
2. The dependency check fails and enters the installation branch.
3. An attacker has compromised a resolved dependency release or controls the package source through pip configuration, a configured mirror, or the execution environment.
4. pip3 install requests beautifulsoup4 -q downloads and processes the attacker-controlled package or build dependency without checking approved versions or hashes.
5. Malicious installation logic execu ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from run.sh. If dependencies are missing, terminate with a clear message and direct the operator to an explicit installation procedure.
2. Declare reviewed, exact dependency versions in a requirements or lock file.
3. Generate and enforce cryptographic hashes for every package and transitive dependency, for example by installing with --require-hashes.
4. Install dependencies inside a dedicated virtual environment rather than modifying the user's global or ambient Python environment.
5. Invoke pip through the selected interpreter, such as python3 -m pip, to ensure interpreter consistency.
6. Use an explicitly configured trusted package index or an internally controlled artifact repository. Do not rely on unreviewed ambient pip configuration.
7. Separate dependency installation from routine execution so installation is a deliberate, auditable deployment step.
8. Run the Skill as a least-privileged account and prevent privileged automation from installing packages dynamically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

声明描述包含一个较完整的“每日 arXiv 论文订阅与推送管理”技能，但给出的代码只实现了 arXiv 论文抓取、解析、摘要获取和文件保存，属于其中“获取整理论文”的子集。代码中没有任何订阅持久化、用户配置、推送时间管理、领域管理、消息发送或触发逻辑。因此描述对能力范围有明显夸大，尤其是订阅/推送/管理相关部分。另一方面，代码访问 arXiv 网络资源并写本地文件，这与“获取整理论文”主线一致，不属于恶意或完全无关行为。综合判断为描述与实际行为不完全一致，存在能力层面的实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明描述的是一个较完整的 arXiv 每日论文获取与订阅管理技能，但提供的代码块仅是 run.sh 启动脚本，主要负责接收领域/路径/日期参数、检查 python3 与 requests/bs4 依赖、必要时安装依赖、创建目录并调用 fetch.py 执行抓取。就该代码块本身而言，其核心能力只是“按分类和日期获取 arXiv 论文”的执行入口。声明中的订阅、推送时间管理、添加领域、话题触发等能力均未在此代码中体现，因此存在描述与实际行为不一致。依赖安装和目录创建属于抓取任务的支持性实现细节，不单独构成额外风险能力。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to read and write local files under references/ and data/, and to invoke a network-fetching script, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap: an agent/runtime may grant broader file or network access than users expect, increasing the chance of unintended file modification or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions include broad everyday phrases like “arxiv”, “每日论文”, and “论文推送”, which can cause the skill to activate in conversations that do not intend file operations, scheduling, or network fetching. Overbroad activation increases the risk of unintended execution, accidental data access, or confusing cross-skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and all user-visible echo messages are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the stated policy, forcing a language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script modifies the host environment by installing Python packages automatically when imports fail. For a skill whose stated purpose is fetching and organizing arXiv papers, unattended package installation is an unnecessary side effect that can change system state, trigger network access, and introduce supply-chain risk if package sources are compromised or unexpected environments are targeted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language documentation entirely in Chinese in the module docstring, and the rest of the script also uses Chinese-only user-facing output. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The launcher performs package installation with only a generic status message, so users may not realize the script is making persistent changes to the host. This reduces transparency and can lead to unexpected dependency changes or network activity, though the direct security impact is limited compared with arbitrary code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.