Security audit

pubmed2blog

Security checks for vulnerabilities and agentic risk

Overview

The skill does the described PubMed-to-blog work, but its default agent workflow includes unsafely scoped recurring cron execution and a mutable global npm install.

Review before installing. Prefer a pinned, locally isolated version of the CLI; run setup in a dedicated workspace; avoid giving broad filesystem access; and do not let an agent create cron jobs unless you explicitly approve the exact command, schedule, credential source, output location, cost expectations, and removal process.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:1
Finding: Unpinned Global Installation of an Unaudited npm Executable
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:55
Finding: Unrestricted Guidance to Establish Recurring Cron Execution
Content: View full analysis
` to find relevant papers 2. Use `pubmed2blog extract ` to get full details 3. Generate with `pubmed2blog generate --type --save` 4. Deliver results to user in chat 5. Schedule via cron for regular content generation ``` ### Technical Analysis The agent instructions recommend scheduling the CLI through cron without requiring explicit user authorization or defining security controls. No fixed executable path, exact dependency version, execution identity, schedule, working directory, output destination, logging policy, credential mechanism, or removal procedure is provided. A cron entry survives the original skill invocation and causes unattended, cross-session execution. This also compounds the dependency risk because the recommended globally installed executable can later resolve to modified package code while the scheduled task continues to run. The instruction does not itself create a cron entry and therefore is not proof that persistence has already been installed. However, an agent following the documented workflow may create persistent execution as a normal step without sufficient user awareness or safeguards. ### Attack Path 1. An agent loads the skill and follows its documented agent-usage sequence. 2. After generating content, the agent interprets step 5 as authorization to create a cron entry. 3. The cron entry invokes the globally installed `pubmed2blog` executable on a recurring schedule. 4. The process runs after the original interaction has ended and may inherit or retrieve stored API credentials. 5. If the executable, configuration, search terms, or package version is later modified, cron repeatedly executes the changed beha ...[truncated 1002 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs agents to run pubmed2blog generate <pmid> --type <type> --save without warning that this writes output to disk. In an agent context, undocumented file creation can violate user expectations, clutter the workspace, or overwrite existing content depending on tool behavior, even if the command appears routine and content-focused.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.