Jason Academic Writing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.1

Overview

The skill is an academic-writing pipeline, but its advertised integrity guarantees are not reliably implemented and it sends manuscript content to external services.

Review this skill carefully before installing, especially for confidential or unpublished manuscripts. It may send drafts and citation metadata to external services, and its integrity reports should not be treated as proof that claims, statistics, methods, or citations were actually verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/write.py:448

Finding

Indirect Prompt Injection Through Untrusted Research and Manuscript Content

Content

View full analysis

Remediation

View remediation

... ``` 3. Instruct the model that delimited material is evidence to analyze, not instructions to execute. 4. Keep instructions and data in separate message or structured-input fields where supported. 5. Validate review responses with a strict JSON Schema: - Reject unknown properties. - Require all expected fields. - Enforce numeric scores from 0 through 100. - Restrict decisions and priorities to enumerated values. - Enforce maximum string and array lengths. 6. Compute all scores and decisions in trusted application code rather than accepting model-selected gate outcomes. 7. Treat revision actions as untrusted data. Convert them to a constrained internal representation instead of placing arbitrary action text into another prompt. 8. Add adversarial tests using abstracts and manuscripts that contain instruction overrides, forged JSON, prompt delimiters, and requests to disclose secrets. 9. Require human review before externally publishing or submitting any generated manuscript. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/integrity_check.py:124

Finding

Integrity Checker Can Certify Unsupported or Unverified Manuscripts

Content

View full analysis

Tuple[List[Dict], Dict]: """Verify all citations in manuscript.""" citations = extract_citations(manuscript) results = [] passed = 0 failed = 0 for cit in citations: if cit.get("doi"): result = verify_doi(cit["doi"]) else: # Try Semantic Scholar result = verify_citation_semantic(cit["raw"]) result["raw_citation"] = cit["raw"] results.append(result) if result.get("valid"): passed += 1 else: failed += 1 summary = { "total": len(citations), "passed": passed, "failed": failed, "pass_rate": passed / len(citations) if citations else 1.0 } return results, summary ``` ```python def verify_claims(manuscript: str, evidence_file: str = None) -> List[Dict]: """Verify claims are supported by evidence.""" claims = [] sentences = manuscript.split('\n') for sent in sentences: if re.search(r'\([A-Z][a-z]+.*\d{4}\)', sent) or re.search(r'\[\d+\]', sent): claim_text = re.sub(r'\([A-Z][a-z]+.*\d{4}[a-z]?\)', '', sent).strip() claim_text = re.sub(r'\[\d+\]', '', claim_text).strip() if claim_text and len(claim_text) > 20: claims.append({"text": claim_text, "sentence": sent}) # TODO: Cross-reference with evidence file results = [] for claim in claims[:10]: results.append({ "claim": claim["text"][:100], "supported": True, # Placeholder - needs evidence mapping "evidence": "pending" }) return results ``` ```python report = { "timestamp": __import__('datetime').datetime.now().isoformat(), "inpu ...[truncated 2809 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:151

Finding

Failed Integrity Gate Does Not Stop the Pipeline

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/write.py:157

Finding

Manuscript Prompts Require Fabrication of Research Data Not Present in the Evidence

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the primary implemented behavior is revision or rewriting while the skill is marketed as a complete integrity-focused academic pipeline, users may wrongly assume outputs have passed verification gates. That mismatch is security-relevant because it undermines trust boundaries and can facilitate accidental dissemination of inaccurate or noncompliant research content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the primary implemented behavior is revision or rewriting while the skill is marketed as a complete integrity-focused academic pipeline, users may wrongly assume outputs have passed verification gates. That mismatch is security-relevant because it undermines trust boundaries and can facilitate accidental dissemination of inaccurate or noncompliant research content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the primary implemented behavior is revision or rewriting while the skill is marketed as a complete integrity-focused academic pipeline, users may wrongly assume outputs have passed verification gates. That mismatch is security-relevant because it undermines trust boundaries and can facilitate accidental dissemination of inaccurate or noncompliant research content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the primary implemented behavior is revision or rewriting while the skill is marketed as a complete integrity-focused academic pipeline, users may wrongly assume outputs have passed verification gates. That mismatch is security-relevant because it undermines trust boundaries and can facilitate accidental dissemination of inaccurate or noncompliant research content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function claims to verify that manuscript claims are supported by evidence, but it unconditionally marks extracted claims as supported: True with a placeholder. In an academic integrity skill, this can create false assurance, allowing unsupported or hallucinated claims to pass review and be represented as validated.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises scripts, environment-variable use, file I/O, shell execution, and external API access, but it does not declare any explicit tool scope or permissions. This is dangerous because a host may grant broader capabilities than users expect, enabling unintended filesystem access, command execution, or outbound data transfer during use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill explicitly uses external APIs, which creates an outbound data-transfer path. In context, this is not inherently malicious for literature lookup, but it becomes dangerous if manuscript text, proprietary research topics, or other sensitive inputs are sent to third parties without clear disclosure, consent, and scoping.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

**APIs used**:
- Semantic Scholar (`https://api.semanticscholar.org`)
- CrossRef DOI (`https://api.crossref.org/works/`)

### Stage 4: Review (5-Person Panel)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The skill is designed to call an external API endpoint, which creates an external transmission channel from a manuscript-integrity tool to a third party. In this context, the risk is not code execution but confidentiality: even partial citation queries can expose unpublished research direction or sensitive draft content.

Content

Scanner excerpt · scripts/integrity_check.py (reported line 19)May include surrounding context.

python

from typing import Dict, List, Tuple

# API endpoints
SEMANTIC_SCHOLAR_API = "https://api.semanticscholar.org/graph/v1/paper/search"
CROSSREF_API = "https://api.crossref.org/works/"

def verify_doi(doi: str) -> Dict:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The CrossRef endpoint similarly represents external transmission from a local manuscript-processing workflow to a third party. Although the data sent here is narrower than full manuscript text, it still creates a privacy and compliance concern for confidential or embargoed academic work.

Content

Scanner excerpt · scripts/integrity_check.py (reported line 20)May include surrounding context.

python

# API endpoints
SEMANTIC_SCHOLAR_API = "https://api.semanticscholar.org/graph/v1/paper/search"
CROSSREF_API = "https://api.crossref.org/works/"

def verify_doi(doi: str) -> Dict:
    """Verify DOI exists and matches metadata via CrossRef."""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code sends manuscript-derived citation text to Semantic Scholar without any user notice, consent, or privacy disclosure. In academic workflows, citation strings or manuscript fragments may reveal confidential research topics, draft content, or unpublished work, creating an avoidable data-leakage risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The overall pass/fail decision is based only on citation pass rate, even though the tool advertises broader integrity checks including claim verification. This can let a manuscript receive a global PASS despite unsupported claims, misleading users into trusting a more comprehensive validation than was actually performed.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/integrity_check.py (reported line 202)May include surrounding context.

python

print("  [3/3] Generating report...")
    
    report = {
        "timestamp": __import__('datetime').datetime.now().isoformat(),
        "input_file": input_file,
        "citations": {
            "summary": citation_summary,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 47)May include surrounding context.

python

}
    
    try:
        proc = subprocess.run(
            command,
            cwd=work_dir,
            capture_output=True,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/research.py (reported line 18)May include surrounding context.

python

load_dotenv()

SEMANTIC_SCHOLAR_API = "https://api.semanticscholar.org/graph/v1/paper/search"

# Evidence levels
EVIDENCE_LEVELS = {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The embedded system prompts and user messages are written entirely in Chinese, causing the skill to operate in a specific language by default. There is no opt-in, configuration, or documented justification for restricting reviews and synthesized output to Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends the full manuscript to an external LLM API, which may expose unpublished research, sensitive data, confidential peer-review content, or regulated information to a third party. In an academic writing skill, this is especially relevant because manuscripts often contain embargoed results, personal data, or proprietary material, and the code provides no explicit consent prompt, redaction step, or local-only option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The embedded prompt is written entirely in Chinese and directs the model's behavior in that language, which imposes a locale/language choice on users. There is no opt-in, configurability, or documented justification showing that the skill is intentionally limited to Chinese-language operation.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The free-form 'action' field from the review roadmap is interpolated directly into the LLM prompt with no sanitization or policy boundary, enabling prompt-injection-style steering through seemingly legitimate reviewer feedback. In an academic writing pipeline, this can be used to manipulate conclusions, insert fabricated citations or unsupported claims, or suppress limitations, which undermines research integrity and may not be obvious to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script sends manuscript text to an external LLM API for revision, but it does not present any explicit notice, consent gate, redaction step, or confidentiality control before transmission. In an academic-writing context, manuscripts may contain unpublished research, personal data, or embargoed material, so silent exfiltration to a third-party service creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Reviewer-derived roadmap entries are treated as trusted editing instructions and passed into the revision workflow, allowing a malicious or compromised review file to steer substantive manuscript changes. In this skill, that is especially relevant because the tool is designed to produce polished academic output, so deceptive feedback can silently inject bias, false claims, removed caveats, or reputation-damaging edits while appearing to be normal revision guidance.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/research.py (reported line 127)May include surrounding context.

python

"source_manuscript": manuscript_file,
        "source_review": review_file,
        "revisions_applied": roadmap[:5],
        "timestamp": __import__('datetime').datetime.now().isoformat()
    }
    Path(log_file).write_text(json.dumps(revision_log, indent=2))

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/review.py (reported line 424)May include surrounding context.

python

"source_manuscript": manuscript_file,
        "source_review": review_file,
        "revisions_applied": roadmap[:5],
        "timestamp": __import__('datetime').datetime.now().isoformat()
    }
    Path(log_file).write_text(json.dumps(revision_log, indent=2))

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/revise.py (reported line 122)May include surrounding context.

python

"source_manuscript": manuscript_file,
        "source_review": review_file,
        "revisions_applied": roadmap[:5],
        "timestamp": __import__('datetime').datetime.now().isoformat()
    }
    Path(log_file).write_text(json.dumps(revision_log, indent=2))

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains multiple user-facing strings in Chinese, including recommendations and the generated Markdown report, while providing no opt-in, configuration, or documented locale constraint. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring states the agent generates a manuscript 'from evidence,' but the code does not constrain the model to only evidence-backed content or detect hallucinated additions. This mismatch is risky because users may trust the output as evidence-grounded when it is actually only prompt-guided, increasing the chance of academic integrity failures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.