Cjg Paper Fact Checker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 2.0.1

Overview

The skill is mostly a coherent paper-checking assistant, but it asks for meeting transcripts, recordings, participant attribution, and default local logging without enough consent and retention controls.

Install only if you are comfortable with a meeting-focused workflow that may use transcripts, recordings, and participant names. Before using it in a lab or company meeting, require explicit consent from affected participants, avoid full recordings unless necessary, redact speaker names when sharing reports, and disable or clarify the default local usage logging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:19

Finding

Default Persistent Usage Logging Without Defined Data Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-21
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Evidence

The following is an English translation of the relevant instruction:

markdown

## Evolution Fuel — Enabled Upon Installation

Installation notice: After installation, “Evolution Fuel” is enabled by default. After every use, method-level labels are automatically recorded. Only method names are recorded, not which paper was checked or the user's identity. The records remain on the local machine for continuous optimization. Users may say “stop recording” to disable it.

Technical Analysis

The Skill instructs the Agent to persist usage metadata automatically after each invocation. Logging is enabled by default rather than through explicit opt-in consent.

Although the instruction states that paper and user identities are not recorded, it does not define:

• The exact fields included in each record.
• The storage path and file format.
• File permissions or access controls.
• Data-retention and deletion periods.
• Whether stored labels may later be transmitted or processed.
• A mechanism for inspecting or deleting previously collected records.
• How the opt-out preference itself is persisted.

This creates unmanaged local state and may expose behavioral information about how the Skill is used. The package contains no implementation showing how this logging is performed, so the actual storage behavior and enforcement of the stated data-minimization boundary cannot be verified.

Attack Path

1. A user installs or invokes the Skill without explicitly opting into telemetry.
2. The Skill's default instruction causes method-level usage labels to be recorded after each run.
3. The records are written to an unspecified persistent local location.
4. Another local process, user, or later Agent session with access to that location may inspect or misus ...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable usage logging by default and require explicit, informed opt-in consent.
2. Document the precise data schema, storage location, format, and intended processing.
3. Enforce restrictive file permissions and isolate records from unrelated users and processes.
4. Define a short retention period and automatically delete expired records.
5. Provide commands to inspect, export, and permanently delete all collected records.
6. Ensure opting out stops future collection and offer deletion of existing records.
7. Prohibit collection of paper identifiers, participant identities, meeting identifiers, transcript text, file paths, and other sensitive context.
8. Add an implementation-level test confirming that logging does not occur before consent.
9. If continuous optimization requires external transmission, disclose it separately and request additional explicit consent before any network transfer.

other

Warning

• Location: SKILL.md:87

Finding

Excessive Collection of Meeting Recordings, Transcripts, and Participant Identity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-91
Vulnerability Type: other: Privacy Overcollection
Risk Level: Medium

Evidence

The following is an English translation of the complete relevant section:

markdown

## Tencent Meeting Integration

- Transcription and intelligent minutes: Detect moments when a paper is shared during a group meeting and automatically start verification.
- Participant information: Record who shared the paper so the report can identify its source.
- Recording: Enable recording before the meeting so it is possible to review which papers were discussed and determine what requires additional checking.

Confirm that the user has authorized access to the meeting data before invoking these capabilities.

The related report template at references/credibility-report.md, line 6, also includes a speaker field:

markdown

Paper: {title} ({author}, {year}) · Shared by: {speaker}

Technical Analysis

Paper verification requires the paper title, DOI, PDF, references, or selected images. Capturing a full meeting recording, processing meeting transcripts, and identifying the participant who shared the paper exceed the minimum information necessary for that purpose.

The instruction requires authorization from the requesting user, which is a positive control, but it does not address:

• Consent from every recorded or transcribed participant.
• Whether the requesting user is authorized to grant access on behalf of others.
• Collection of unrelated speech or confidential meeting content.
• Data minimization and redaction.
• Storage location, retention, deletion, and access controls.
• Whether participant identity is necessary in the generated report.
• Distribution of reports containing participant attribution.

Automatically triggering verification from meeting transcripts further increases the possibility that content will be processed before parti ...[truncated 1697 chars]

Remediation

View remediation

Remediation Suggestions

1. Make direct submission of a title, DOI, PDF, reference list, or selected image the default workflow.
2. Make transcription access, recording access, and participant attribution separate opt-in capabilities.
3. Verify that all affected participants have been informed and that applicable consent requirements are satisfied.
4. Process only the shortest transcript excerpt needed to identify the paper and immediately discard unrelated content.
5. Do not recommend full-meeting recording solely for paper verification.
6. Remove the speaker field from the default report template; include it only when the user provides a documented need.
7. Redact participant names and meeting identifiers before storing or distributing reports.
8. Define retention periods, deletion procedures, encryption requirements, and role-based access controls for meeting-derived data.
9. Require confirmation before automatically starting a verification action from transcript content.
10. Clearly state that user authorization alone may not satisfy participant-consent, institutional-policy, or legal requirements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The telemetry section states that method-level tags are automatically recorded after each use and frames the collection as harmless because it omits the paper and user identity. This is still a logging risk: automatic collection without explicit opt-in can capture behavioral metadata, and minimization language may downplay privacy implications or obscure retention and access details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes automatic activation from Tencent Meeting transcription, attendee attribution, and use of recording features in a meeting context that can involve personal data and sensitive research content. Although it mentions confirming authorization before accessing meeting data, the user-facing flow does not clearly require explicit per-use consent before auto-triggering or before attributing a paper to a named participant, creating a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Instructing the skill to label who shared a paper links research interests or actions to identifiable meeting participants, which creates unnecessary personal-data exposure and retention risk. In a meeting or lab setting this can reveal reading behavior, authorship associations, or internal project direction, especially if reports are stored or shared beyond the session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The display name is explicitly prefixed with Chinese-language context and the document is primarily written in Chinese, but there is no statement offering users a language choice or clarifying that Chinese is optional. Under the policy, forcing a specific language without opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.