T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:99- Finding
Authenticated Write Operations Exceed the Skill's Declared Read-Only Purpose
- Content
View full analysis
- Remediation
View remediation
Security audit
Hugging Face Papers
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a paper lookup helper, but it also documents authenticated Hugging Face write actions that can change account or public paper state without clear confirmation guidance.
Install only if you want the agent to have instructions for Hugging Face paper administration as well as reading. For normal summaries or analysis, do not provide HF_TOKEN; if you do provide one, use a narrowly scoped token and require explicit confirmation before any claim, index, or link update.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
The content of a paper can be fetched as markdown like so:
bash curl -s "https://huggingface.co/papers/{PAPER_ID}.md"This should return the Hugging Face paper page as markdown. This relies on the HTML version of the paper at https://arxiv.org/html/{PAPER_ID}.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is described as a read-oriented paper lookup and analysis tool, but its documentation includes authenticated write operations such as claiming authorship, indexing papers, and updating paper links. This creates dangerous capability drift: an agent using this skill could be induced to perform account-scoped modifications unrelated to the user’s request, especially if it has access to an HF token.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented capabilities include administrative, account-scoped operations that act on behalf of a logged-in Hugging Face user or organization, despite the skill’s stated purpose being paper reading and analysis. Exposing these privileged actions in the same skill increases the chance of misuse, prompt injection–driven action selection, or accidental modification of user/account state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents authenticated POST endpoints that can change Hugging Face state, but provides no warning, consent flow, or confirmation guidance before using them. In an agent setting, omission of such guardrails materially raises the risk of unintended account actions if a prompt or retrieved content nudges the model toward those endpoints.
- Content