Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent paper-review purpose, but its helper scripts can read arbitrary local text/HTML paths and fetch unrestricted URLs, which is broader than users may expect.
Install only if you trust the sources you will give it and can run it in a constrained environment. Avoid sensitive local paths or private PDFs unless you intend their contents to be processed, and prefer sandboxed filesystem and network egress controls because the scripts do not enforce those limits themselves.
scripts/extract-paper-records.mjs:278Unrestricted Server-Side Request Forgery Through User-Controlled URLs and Redirects
scripts/extract-paper-records.mjs:404Arbitrary Local-File Read Through Generic Path and Unvalidated Manifest Records
scripts/extract-paper-records.mjs:278Unbounded Remote Response Buffering Allows Resource Exhaustion
scripts/extract-paper-records.mjs:335Untrusted Remote Paper Content Is Promoted to Primary Agent Context
Referenced artifact was not completely inspected
- Use `scripts/normalize-sources.mjs` when the source set is mixed or should be stored as a reusable manifest.
Referenced artifact was not completely inspected
- Use `scripts/normalize-sources.mjs` when the source set is mixed or should be stored as a reusable manifest.
Referenced artifact was not completely inspected
- Use `scripts/extract-paper-records.mjs` to turn PDFs and URLs into structured records before classification.
Referenced artifact was not completely inspected
- Use `scripts/extract-paper-records.mjs` to turn PDFs and URLs into structured records before classification.
Referenced artifact was not completely inspected
### `scripts/render-formal-review-template.mjs`
The skill explicitly instructs use of scripts that fetch external URLs and process paper sources, but it does not declare any tool permissions or allowed-tools scope. This creates a capability/expectation mismatch that can lead to unauthorized network access or execution in environments where users and reviewers cannot clearly see what external actions the skill may perform.
The skill tells the agent to fetch remote URLs and extract content from local PDFs without warning the user that document contents or derived metadata may be transmitted to external services. In a literature-review workflow, local PDFs may contain unpublished, licensed, or sensitive material, so silent network use increases confidentiality and compliance risk.
The skill allows implicit invocation without any visible activation scope, caller constraints, or narrowing conditions. That increases the chance the agent will auto-select this skill in contexts involving URLs or documents, causing unreviewed access to local PDFs or remote paper links and expanding the attack surface for prompt injection, unintended data processing, or exfiltration through fetched content.
The template includes fixed Chinese section headings in the "Typical review shape," which can steer the agent to produce output in Chinese even when the user did not request that language. This is a prompt-quality and instruction-alignment issue: it can cause unexpected language switching, reduce usability, and break downstream consumers that expect English or user-selected output, but it is not a direct code-execution or data-exfiltration risk.
This skill's stated purpose is to extract structured paper records from files and URLs, which justifies file and network access, but not invoking arbitrary local executables via the shell. The code probes for and runs external tools (pdftotext, mutool, python3, strings) and executes inline Python, introducing a broader execution capability than is necessary from the manifest description alone.
The script fetches arbitrary HTTP/HTTPS sources provided by the user, which transmits network requests and identifying request metadata such as the configured User-Agent. While this behavior is part of extraction, the code provides no confirmation prompt, log message, comment, or docstring warning that remote URLs will be contacted.
The script hardcodes Chinese headings and template text such as "分类表", "摘要", and "基于给定文献语料的综述" in its generated output while the CLI help and surrounding code are otherwise in English. This creates a natural-language locale policy issue because users are not given an opt-in or alternative language selection.
The markdown file states that the skill extracts and reviews papers from local PDFs or URLs, which implies reading local files and fetching remote content. However, it does not warn users that local document contents may be processed or that URLs may trigger network access, which are behaviors that can affect privacy and system/network activity.
The documentation states that references are formatted in GB/T 7714, which imposes a specific locale/style convention. Because no opt-in, alternative style choice, or justification is provided, this may violate the language/locale policy for skills that should not force a specific locale-specific output format by default.
This is a natural-language locale/style constraint that forces a specific regional bibliographic format. The file does not indicate that the style is optional, user-selected, or required for a particular compliance context, so it can violate language/locale choice expectations.
When a remote source is a PDF, the script writes the downloaded content to a temporary file under the system temp directory before processing it. Although the file is later removed, the script does not disclose this filesystem write anywhere in help text, comments, or user-visible logging.
This code performs a filesystem write when --out is provided, but there is no confirmation prompt, warning message, or inline comment/docstring disclosing that it will create or overwrite the target file. The help text describes normalization behavior but does not explicitly warn that a file path supplied via --out will be written.
Detected: suspicious.dangerous_exec