Scientific Graphical Abstract Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:52 AM UTC
• Version: 0.1.2

Overview

The skill mostly builds local SVG diagrams, but its install path and SVG output handling create risks users should review before installing.

Review this skill before installing. Prefer the built-in venv setup over the curl-to-shell uv installer, pin the skill and dependencies to reviewed versions, and avoid embedding generated SVGs from untrusted prompts or data into websites until SVG text and attributes are properly escaped. Do not rely on the advertised AI-model support unless the implementation is updated to actually use and disclose provider calls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:60
• Finding: Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 60 **Vulnerability Type**: Unverified remote code execution through a shell pipeline **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions pipe content retrieved from a mutable external URL directly into `sh`. The remote response is executed before the user has an opportunity to inspect it, and the instructions do not verify a pinned version, cryptographic checksum, or digital signature. The cited domain appears to be associated with the legitimate `uv` project, but domain reputation does not eliminate the underlying security risk. Compromise of the hosting infrastructure, DNS resolution, TLS termination, or upstream release process could change the effective payload after this Skill has been reviewed. This behavior exceeds the minimum privileges needed by the declared SVG-generation functionality. The project can run using Python's built-in `venv`, which the same README already documents, and its core script does not import or invoke `uv`. ### Attack Path 1. A user follows the recommended dependency-installation instructions. 2. `curl` retrieves the current response from the external URL. 3. The response is passed directly to `sh` without local review or integrity verification. 4. If the endpoint or delivery path is compromised, attacker-controlled shell commands execute immediately. 5. Those commands inherit the privileges, environment, filesystem access, and network access of the user running the installer. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. Potential impact includes: - Reading or modifying files accessible to the user. - Accessing credentials and tokens exposed to the shell environment. - Installing additional software or persistence mechanisms where user permissions allow. - Modifying developmen ...[truncated 327 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline and recommend the already documented built-in virtual-environment installation path: ```bash python -m venv .venv source .venv/bin/activate python -m pip install -r requirements.txt ``` 2. If `uv` remains an optional recommendation, prefer installation through a trusted platform package manager with a pinned package version. 3. If a standalone installer must be used: - Pin a specific installer or release version. - Download it to a local file instead of piping it into a shell. - Verify a publisher-provided cryptographic signature or checksum. - Review the downloaded script before execution. - Execute it without administrative privileges. 4. Explicitly warn users not to run installation commands as `root` or through `sudo` unless a documented component strictly requires it. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: graphical_abstract_generator.py:78
• Finding: Unescaped User-Controlled Content Is Embedded in Generated SVG Files<![CDATA[ ## Vulnerability Details **File Location**: `graphical_abstract_generator.py`, lines 78–83 **Additional Locations**: Prompt and workflow text reaches this sink from lines 350–365 and 453–455. **Vulnerability Type**: SVG/XML markup injection **Risk Level**: High ### Vulnerable Code ```python svg_text = f'<text id="{element_id}" x="{x}" y="{y}" ' svg_text += f'font-family="Arial, sans-serif" font-size="{font_size}" ' svg_text += f'fill="{fill}" font-weight="{font_weight}" ' svg_text += f'text-anchor="{anchor}">{text}</text>' self.elements.append(svg_text) return element_id ``` One direct user-controlled call site is: ```python self.svg_builder.add_text(400, 300, f'"{prompt[:100]}..."', font_size=12, anchor="middle", fill="#495057", font_weight="italic") ``` Workflow steps, chart labels, titles, and labels loaded from input data are also passed to SVG-building methods without XML escaping. ### Technical Analysis The generator constructs SVG as strings and inserts the `text` value directly between XML tags. Characters with structural meaning in XML, including `<`, `>`, and `&`, are not escaped. An attacker can supply a prompt or data label containing content such as a closing `</text>` tag followed by attacker-selected SVG elements. This allows the attacker to leave the intended text node and inject arbitrary SVG/XML markup into the generated file. Depending on how the SVG is opened or embedded, injected markup can include: - Links or deceptive overlays used for phishing. - External resource references that cause network requests. - Event-handler attributes or script elements in permissive browser contexts. - Elements that obscure or replace the intended scientific visualization. The exact execution behavior of scripts and event handlers depends on the SVG viewer and embedding context. Nevertheless, the generated document is structurally attacker-controlled, and the README explicitly describes ...[truncated 1619 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. XML-escape every untrusted value placed in an SVG text node: ```python from xml.sax.saxutils import escape safe_text = escape(str(text), { '"': "&quot;", "'": "&apos;", }) ``` 2. Use attribute-specific encoding such as `xml.sax.saxutils.quoteattr` for values inserted into XML attributes. 3. Prefer a maintained SVG/XML construction library that creates text nodes and attributes through a structured API rather than concatenating strings. 4. Apply escaping consistently to: - Prompt excerpts. - Workflow steps. - Chart titles and labels. - `<title>` labels. - Values originating from CSV or JSON files. 5. Validate non-text fields with strict allowlists: - Accept colors only in supported hexadecimal or predefined color formats. - Require dimensions and coordinates to be finite numbers within reasonable bounds. - Restrict font weight, text anchor, and similar attributes to known-safe values. 6. Add regression tests using payloads containing XML metacharacters, closing tags, `<script>`, event handlers, external references, and nested SVG elements. 7. If generated files are served on the web, use restrictive Content Security Policy headers and serve untrusted SVG files as downloads rather than embedding them inline. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:29
• Finding: Dependency Installation Is Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 29 **Additional Location**: `requirements.txt`, lines 4–21 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/JackKuo666/scientific-graphical-abstract-skill.git ``` The Python requirements also use open-ended lower bounds: ```text matplotlib>=3.7.0 plotly>=5.14.0 pandas>=2.0.0 numpy>=1.24.0 svgwrite>=1.4.0 cairosvg>=2.5.0 pillow>=10.0.0 ``` ### Technical Analysis The recommended `npx` installation does not pin the invoked tooling to a reviewed version, and the Git repository URL does not specify a commit or immutable release reference. Consequently, the code and installation behavior obtained by a future user can differ from the version audited here. The Python dependency constraints permit any future release at or above the stated minimum version. There is no lockfile or hash verification, so installations are not reproducible and automatically trust future package releases and their transitive dependencies. No evidence in the audited files demonstrates that the named packages are currently malicious. The vulnerability is the absence of controls that constrain dependency resolution to reviewed artifacts. The risk is also disproportionate to the implementation: the audited Python script uses the standard library for its active functionality and does not import the listed plotting, data-processing, image-processing, or SVG packages. Installing this broad dependency set unnecessarily expands the supply-chain and native-library attack surface. ### Attack Path 1. A user follows the recommended installation instructions at a later date. 2. `npx`, Git, or `pip` resolves mutable or newly released third-party content. 3. A compromised upstream release, transitive dependency, repository branch, or package-manager account supplies hostile installation code. 4. The package manager runs in ...[truncated 913 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Skill installation to an immutable, reviewed release tag or commit hash instead of a mutable repository branch. 2. Pin the version of the package-management tool invoked through `npx`, or document installation through a separately verified tool. 3. Replace open-ended requirements with a reviewed lockfile containing exact versions and cryptographic hashes. 4. Use a tool such as `pip-tools`, `uv lock`, or an equivalent reproducible resolver to lock direct and transitive dependencies. 5. Remove packages that are not imported or required by the current implementation. Based on the audited script, most or all listed runtime dependencies appear unnecessary for its standard-library SVG-generation path. 6. Separate optional functionality into extras so users do not install plotting, conversion, or image-processing packages unless those capabilities are actually required. 7. Add automated dependency vulnerability scanning and a controlled update process in which version changes are reviewed and tested before the lockfile is updated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (21)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/scientific-graphical-abstract-skill

• Confidence: 98% confidence
• Finding: The `| sh` pattern is a classic command-chaining hazard because it causes uninspected remote content to execute directly in a shell. In the context of a skill README meant for easy installation, this increases the likelihood that users will copy-paste it blindly, making compromise more dangerous and more realistic.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

%(prog)s generate --data results.csv --type line --output line.svg

  # Use specific model
  %(prog)s generate --prompt "Create a mechanism diagram" --model claude --output diagram.svg
        """
    )

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Overview

**Scientific Graphical Abstract Generator** is a Claude Code Skill designed to help researchers create professional, publication-quality graphical abstracts for scientific papers. It generates editable SVG visualizations that can be customized for journal requirements.

### Key Features

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/scientific-graphical-abstract-skill
uv venv
source .venv/bin/activate  # Linux/macOS

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README encourages use of Anthropic, OpenAI, and DeepSeek API keys and hosted models, but does not warn users that prompts, research text, images, or dataset contents may be transmitted to third-party services. In a scientific research context, this can expose unpublished results, sensitive datasets, or confidential manuscript content to external providers without informed consent.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module docstring says it generates graphical abstracts using multiple AI models, and the CLI examples/options reinforce that claim, but the implementation only parses prompts locally and builds SVGs with hardcoded templates and simple regex extraction. This is an active contradiction about the skill's core behavior, not just missing detail.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The examples present line-chart generation from CSV and choosing a specific AI model as real supported behaviors. In practice, no model is ever called anywhere in the code, and CSV rows are loaded as generic header-keyed dictionaries while chart generation expects 'label' and 'value' keys, so the documented behavior is inconsistent with what the program actually does.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The program writes directly to a user-specified output path without checking whether the file already exists or warning before overwrite. In a CLI skill context, this can cause destructive modification of arbitrary files accessible to the running user, especially if an agent or wrapper passes attacker-influenced paths or runs in an automated workflow.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies
cd ~/.claude/skills/scientific-graphical-abstract-skill

• Confidence: 97% confidence
• Finding: The README recommends `curl -LsSf https://astral.sh/uv/install.sh | sh`, which fetches a remote script and executes it immediately without integrity verification. If the remote host, network path, or delivered script is compromised, users could run arbitrary code on their machine during installation.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This requirements file contains natural-language comments entirely in Chinese, such as the dependency descriptions and optional-install notes. For a general-purpose skill artifact, this imposes a specific language without any stated opt-in, alternative locale, or justification that the skill is region-specific.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Scientific Graphical Abstract Generator 依赖列表

# 图形生成库
matplotlib>=3.7.0
plotly>=5.14.0

# 数据处理

• Confidence: 90% confidence
• Finding: Using a lower-bound specifier for matplotlib allows future, unreviewed versions to be installed, which weakens supply-chain reproducibility and can unintentionally pull in vulnerable or incompatible releases. In isolation this is a low-severity dependency hygiene issue rather than evidence of a malicious package.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 图形生成库
matplotlib>=3.7.0
plotly>=5.14.0

# 数据处理
pandas>=2.0.0

• Confidence: 90% confidence
• Finding: The unpinned plotly dependency permits installation of arbitrary newer releases, reducing reproducibility and making it harder to verify whether deployed versions are secure. This creates a modest supply-chain risk if a bad or breaking upstream release is later consumed automatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

plotly>=5.14.0

# 数据处理
pandas>=2.0.0
numpy>=1.24.0

# AI模型集成 (可选，根据需要安装)

• Confidence: 92% confidence
• Finding: An unpinned pandas dependency means the environment may resolve to different versions over time, complicating assurance that installed builds are free of known issues. Because pandas has historical advisories, leaving it open-ended increases uncertainty and supply-chain exposure.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Because pandas is not pinned, it is impossible to verify from this manifest whether a deployed environment will avoid versions associated with known advisories. The cited issue is disputed and context-dependent, so the direct risk here is uncertainty rather than confirmed exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas>=2.0.0
numpy>=1.24.0

# AI模型集成 (可选，根据需要安装)
# anthropic>=0.18.0  # Claude API

• Confidence: 93% confidence
• Finding: Specifying numpy with only a minimum version allows later unresolved versions to be installed, which can include vulnerable or unstable releases. Given numpy's broad use and advisory history, this is a real but low-severity dependency management weakness.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Numpy has multiple historical advisories, and the absence of a pinned version prevents determining whether installations are affected. In a package that may process untrusted scientific data or files, unresolved numpy version selection can increase the chance of denial-of-service or memory-safety exposure through vulnerable builds.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# deepseek           # DeepSeek API (如果可用)

# SVG处理 (可选)
svgwrite>=1.4.0
cairosvg>=2.5.0  # 用于SVG转PNG

# 图像处理 (可选)

• Confidence: 88% confidence
• Finding: The svgwrite dependency is not fixed to a specific version, so future installs may consume unreviewed upstream changes. This is a standard supply-chain hygiene issue and is more relevant if the project processes externally supplied SVG content.

Unverifiable Dependency: cairosvg has 6 known advisory(ies) (CVE-2026-31899 (CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification); CVE-2021-21236 (Regular Expression Denial of Service in CairoSVG); CVE-2023-27586 (CairoSVG improperly processes SVG files loaded from external resources) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: CairoSVG has known issues involving resource exhaustion and unsafe handling of external SVG resources, and the manifest does not constrain the installed version. In this skill's context—graphical abstract and SVG/PNG generation—this is more relevant because the component is directly tied to parsing/rendering potentially complex SVG content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

cairosvg>=2.5.0  # 用于SVG转PNG

# 图像处理 (可选)
pillow>=10.0.0

• Confidence: 92% confidence
• Finding: Pillow is installed with only a minimum version, allowing different environments to resolve to different future releases. Since image libraries often handle attacker-controlled files and Pillow has prior security advisories, leaving it unpinned creates avoidable risk.

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow has a long history of vulnerabilities in image parsing, and the unpinned requirement makes it impossible to confirm whether safe versions will be used. This is more significant in a graphics-oriented skill because image libraries may process attacker-influenced files, increasing the practical attack surface for denial-of-service or code-execution-class flaws if an affected release is installed.

Static analysis

No suspicious patterns detected.