T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:60- Finding
Remote Installer Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Scientific Graphical Abstract Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly builds local SVG diagrams, but its install path and SVG output handling create risks users should review before installing.
Review this skill before installing. Prefer the built-in venv setup over the curl-to-shell uv installer, pin the skill and dependencies to reviewed versions, and avoid embedding generated SVGs from untrusted prompts or data into websites until SVG text and attributes are properly escaped. Do not rely on the advertised AI-model support unless the implementation is updated to actually use and disclose provider calls.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
graphical_abstract_generator.py:78- Finding
Unescaped User-Controlled Content Is Embedded in Generated SVG Files
- Content
View full analysis
{text}' self.elements.append(svg_text) return element_id ``` One direct user-controlled call site is: ```python self.svg_builder.add_text(400, 300, f'"{prompt[:100]}..."', font_size=12, anchor="middle", fill="#495057", font_weight="italic") ``` Workflow steps, chart labels, titles, and labels loaded from input data are also passed to SVG-building methods without XML escaping. ### Technical Analysis The generator constructs SVG as strings and inserts the `text` value directly between XML tags. Characters with structural meaning in XML, including `<`, `>`, and `&`, are not escaped. An attacker can supply a prompt or data label containing content such as a closing `` tag followed by attacker-selected SVG elements. This allows the attacker to leave the intended text node and inject arbitrary SVG/XML markup into the generated file. Depending on how the SVG is opened or embedded, injected markup can include: - Links or deceptive overlays used for phishing. - External resource references that cause network requests. - Event-handler attributes or script elements in permissive browser contexts. - Elements that obscure or replace the intended scientific visualization. The exact execution behavior of scripts and event handlers depends on the SVG viewer and embedding context. Nevertheless, the generated document is structurally attacker-controlled, and the README explicitly describes ...[truncated 1619 chars]- Remediation
View remediation
` labels. - Values originating from CSV or JSON files. 5. Validate non-text fields with strict allowlists: - Accept colors only in supported hexadecimal or predefined color formats. - Require dimensions and coordinates to be finite numbers within reasonable bounds. - Restrict font weight, text anchor, and similar attributes to known-safe values. 6. Add regression tests using payloads containing XML metacharacters, closing tags, `
T08 · Insecure Dependencies
Warning
- Location
README.md:29- Finding
Dependency Installation Is Not Reproducibly Pinned
- Content
View full analysis
=3.7.0 plotly>=5.14.0 pandas>=2.0.0 numpy>=1.24.0 svgwrite>=1.4.0 cairosvg>=2.5.0 pillow>=10.0.0 ``` ### Technical Analysis The recommended `npx` installation does not pin the invoked tooling to a reviewed version, and the Git repository URL does not specify a commit or immutable release reference. Consequently, the code and installation behavior obtained by a future user can differ from the version audited here. The Python dependency constraints permit any future release at or above the stated minimum version. There is no lockfile or hash verification, so installations are not reproducible and automatically trust future package releases and their transitive dependencies. No evidence in the audited files demonstrates that the named packages are currently malicious. The vulnerability is the absence of controls that constrain dependency resolution to reviewed artifacts. The risk is also disproportionate to the implementation: the audited Python script uses the standard library for its active functionality and does not import the listed plotting, data-processing, image-processing, or SVG packages. Installing this broad dependency set unnecessarily expands the supply-chain and native-library attack surface. ### Attack Path 1. A user follows the recommended installation instructions at a later date. 2. `npx`, Git, or `pip` resolves mutable or newly released third-party content. 3. A compromised upstream release, transitive dependency, repository branch, or package-manager account supplies hostile installation code. 4. The package manager runs in ...[truncated 913 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| shpattern is a classic command-chaining hazard because it causes uninspected remote content to execute directly in a shell. In the context of a skill README meant for easy installation, this increases the likelihood that users will copy-paste it blindly, making compromise more dangerous and more realistic.- Content
bash # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies cd ~/.claude/skills/scientific-graphical-abstract-skill
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
python %(prog)s generate --data results.csv --type line --output line.svg # Use specific model %(prog)s generate --prompt "Create a mechanism diagram" --model claude --output diagram.svg """ )
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Overview **Scientific Graphical Abstract Generator** is a Claude Code Skill designed to help researchers create professional, publication-quality graphical abstracts for scientific papers. It generates editable SVG visualizations that can be customized for journal requirements. ### Key Features
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies cd ~/.claude/skills/scientific-graphical-abstract-skill uv venv source .venv/bin/activate # Linux/macOS
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README encourages use of Anthropic, OpenAI, and DeepSeek API keys and hosted models, but does not warn users that prompts, research text, images, or dataset contents may be transmitted to third-party services. In a scientific research context, this can expose unpublished results, sensitive datasets, or confidential manuscript content to external providers without informed consent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring says it generates graphical abstracts using multiple AI models, and the CLI examples/options reinforce that claim, but the implementation only parses prompts locally and builds SVGs with hardcoded templates and simple regex extraction. This is an active contradiction about the skill's core behavior, not just missing detail.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples present line-chart generation from CSV and choosing a specific AI model as real supported behaviors. In practice, no model is ever called anywhere in the code, and CSV rows are loaded as generic header-keyed dictionaries while chart generation expects 'label' and 'value' keys, so the documented behavior is inconsistent with what the program actually does.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The program writes directly to a user-specified output path without checking whether the file already exists or warning before overwrite. In a CLI skill context, this can cause destructive modification of arbitrary files accessible to the running user, especially if an agent or wrapper passes attacker-influenced paths or runs in an automated workflow.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The README recommends
curl -LsSf https://astral.sh/uv/install.sh | sh, which fetches a remote script and executes it immediately without integrity verification. If the remote host, network path, or delivered script is compromised, users could run arbitrary code on their machine during installation.- Content
bash # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies cd ~/.claude/skills/scientific-graphical-abstract-skill
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This requirements file contains natural-language comments entirely in Chinese, such as the dependency descriptions and optional-install notes. For a general-purpose skill artifact, this imposes a specific language without any stated opt-in, alternative locale, or justification that the skill is region-specific.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Using a lower-bound specifier for matplotlib allows future, unreviewed versions to be installed, which weakens supply-chain reproducibility and can unintentionally pull in vulnerable or incompatible releases. In isolation this is a low-severity dependency hygiene issue rather than evidence of a malicious package.
- Content
text # Scientific Graphical Abstract Generator 依赖列表 # 图形生成库 matplotlib>=3.7.0 plotly>=5.14.0 # 数据处理
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The unpinned plotly dependency permits installation of arbitrary newer releases, reducing reproducibility and making it harder to verify whether deployed versions are secure. This creates a modest supply-chain risk if a bad or breaking upstream release is later consumed automatically.
- Content
text # 图形生成库 matplotlib>=3.7.0 plotly>=5.14.0 # 数据处理 pandas>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
An unpinned pandas dependency means the environment may resolve to different versions over time, complicating assurance that installed builds are free of known issues. Because pandas has historical advisories, leaving it open-ended increases uncertainty and supply-chain exposure.
- Content
text plotly>=5.14.0 # 数据处理 pandas>=2.0.0 numpy>=1.24.0 # AI模型集成 (可选，根据需要安装)
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
Because pandas is not pinned, it is impossible to verify from this manifest whether a deployed environment will avoid versions associated with known advisories. The cited issue is disputed and context-dependent, so the direct risk here is uncertainty rather than confirmed exposure.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Specifying numpy with only a minimum version allows later unresolved versions to be installed, which can include vulnerable or unstable releases. Given numpy's broad use and advisory history, this is a real but low-severity dependency management weakness.
- Content
text # 数据处理 pandas>=2.0.0 numpy>=1.24.0 # AI模型集成 (可选，根据需要安装) # anthropic>=0.18.0 # Claude API
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Numpy has multiple historical advisories, and the absence of a pinned version prevents determining whether installations are affected. In a package that may process untrusted scientific data or files, unresolved numpy version selection can increase the chance of denial-of-service or memory-safety exposure through vulnerable builds.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The svgwrite dependency is not fixed to a specific version, so future installs may consume unreviewed upstream changes. This is a standard supply-chain hygiene issue and is more relevant if the project processes externally supplied SVG content.
- Content
text # deepseek # DeepSeek API (如果可用) # SVG处理 (可选) svgwrite>=1.4.0 cairosvg>=2.5.0 # 用于SVG转PNG # 图像处理 (可选)
Unverifiable Dependency: cairosvg has 6 known advisory(ies) (CVE-2026-31899 (CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification); CVE-2021-21236 (Regular Expression Denial of Service in CairoSVG); CVE-2023-27586 (CairoSVG improperly processes SVG files loaded from external resources) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
CairoSVG has known issues involving resource exhaustion and unsafe handling of external SVG resources, and the manifest does not constrain the installed version. In this skill's context—graphical abstract and SVG/PNG generation—this is more relevant because the component is directly tied to parsing/rendering potentially complex SVG content.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Pillow is installed with only a minimum version, allowing different environments to resolve to different future releases. Since image libraries often handle attacker-controlled files and Pillow has prior security advisories, leaving it unpinned creates avoidable risk.
- Content
text cairosvg>=2.5.0 # 用于SVG转PNG # 图像处理 (可选) pillow>=10.0.0
Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Pillow has a long history of vulnerabilities in image parsing, and the unpinned requirement makes it impossible to confirm whether safe versions will be used. This is more significant in a graphics-oriented skill because image libraries may process attacker-influenced files, increasing the practical attack surface for denial-of-service or code-execution-class flaws if an affected release is installed.
- Content
Static analysis
No suspicious patterns detected.