arxiv-daily

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:27 AM UTC
• Version: 0.9.1

Overview

The skill mostly matches its arXiv paper-fetching purpose, but it can silently install unpinned Python packages and persist delivery identifiers for scheduled pushes, so it needs review before use.

Before installing, decide whether you are comfortable with recurring timers, local storage of paper data and delivery identifiers, and a script that may install Python packages automatically. Prefer installing pinned dependencies in a virtual environment yourself, keep output paths inside the skill directory, and review or remove any timers and like-*.txt configuration files when you no longer want the subscription.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/run.sh:43

Finding

Automatic Installation of Unpinned Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/run.sh, lines 43-47
Vulnerability Type: Supply-chain risk caused by automatic installation of unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

# 检查依赖库
python3 -c "import requests, bs4" 2>/dev/null
if [ $? -ne 0 ]; then
    echo "正在安装必要的依赖库..."
    pip3 install requests beautifulsoup4 -q
fi

Technical Analysis

The wrapper automatically installs requests and beautifulsoup4 when either required import is unavailable. Neither package is pinned to a reviewed version, and no cryptographic hashes or trusted package-index configuration are specified.

As a result, the code installed at runtime can differ from the code that was evaluated during this audit. Package resolution depends on the invoking environment's pip configuration and currently available package releases. A compromised package release, compromised package repository, or attacker-controlled pip index configuration could therefore supply malicious package content. Installation may execute package build or installation logic before the paper-fetching script starts.

This is classified as T08: Insecure Dependencies because the risk is introduced through mutable and insufficiently constrained third-party dependencies.

Attack Path

1. The invoking environment does not have requests or bs4 available, causing the import check to fail.
2. An attacker compromises a dependency release or package repository, or influences pip configuration to point to a malicious index or proxy.
3. run.sh executes pip3 install requests beautifulsoup4 -q without version or hash validation.
4. pip retrieves and installs the attacker-controlled package artifact.
5. Malicious build, installation, or imported runtime code executes with the privileges of the user running run.sh.
6. The malicious dependency can access resources available to that user and may alter subsequent script behavior.

Impact Assessment

Successful e ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from run.sh. If dependencies are unavailable, terminate with a clear message directing the operator to an explicit installation procedure.
2. Declare dependencies in a dedicated requirements or lock file using exact, reviewed versions.
3. Generate and verify cryptographic hashes for every package artifact. Install with a command such as:

bash

python3 -m pip install --require-hashes -r requirements.txt

4. Install dependencies inside a project-specific virtual environment rather than the invoking user's global Python environment.
5. Explicitly use an approved package repository and prevent unexpected fallback to additional indexes.
6. Review and update pinned dependencies through a controlled process that includes vulnerability scanning and integrity verification.
7. Prefer prebuilt, verified artifacts where appropriate, and avoid executing untrusted source-distribution build logic.
8. Document dependency installation as a separate administrative step so running the Skill does not silently mutate the environment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

To the extent the skill actually performs undeclared environment modification such as automatic pip installation and local file writes, that is a real security concern because it expands side effects beyond the stated purpose. Undisclosed installation behavior can alter the runtime environment, introduce supply-chain risk, and violate least-privilege expectations for a seemingly simple paper-fetching skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

To the extent the skill actually performs undeclared environment modification such as automatic pip installation and local file writes, that is a real security concern because it expands side effects beyond the stated purpose. Undisclosed installation behavior can alter the runtime environment, introduce supply-chain risk, and violate least-privilege expectations for a seemingly simple paper-fetching skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill describes behavior that reads and writes local files and invokes a network-fetching script, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing capability declarations can cause the agent to run with broader-than-expected access, reducing reviewability and increasing the chance of unintended file writes or network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to activate on ordinary conversation about arXiv, daily papers, or paper push notifications rather than on clear user intent to run this skill. Over-broad triggering can cause unintended collection, configuration changes, or file/network operations in response to casual discussion, which is especially risky for a skill that stores preferences and may guide task scheduling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to persist delivery metadata such as channel, account, and chat_id without an explicit privacy warning, consent flow, retention policy, or minimization guidance. These identifiers may be sensitive operational metadata, and storing them in plaintext configuration files increases the risk of accidental disclosure, misuse, or cross-user confusion in shared environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script automatically installs Python packages at runtime when imports fail, causing side effects beyond the advertised purpose of fetching arXiv papers. This can modify the host environment, pull code from package repositories without explicit approval, and create supply-chain risk if package sources or dependency resolution are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Running pip3 install automatically and without an explicit warning or confirmation means the skill can change the system state and fetch executable third-party code without informed user consent. In an agent skill context, this is more dangerous because users expect a content-fetching utility, not silent package installation on their machine or runner.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments, usage instructions, and runtime messages are entirely in Chinese, which imposes a specific language on all users. Under the policy, forced language choice without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.