Research Review Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.0.0

Overview

This literature-review skill is mostly purpose-aligned, but its installation metadata can pull unrelated unpinned npm packages and its paper retrieval uses plaintext HTTP.

Install only if you are comfortable reviewing or fixing the dependency metadata first. Prefer removing the npm dependencies or replacing them with properly pinned Python requirements, and change arXiv access to HTTPS before relying on generated review content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: review_generator.py:27

Finding

Plaintext HTTP Used for arXiv Metadata Retrieval

Content

View full analysis

Vulnerability Details

File Location: review_generator.py, lines 27 and 46
Vulnerability Type: Plaintext transport for external research metadata
Risk Level: Medium

Complete Vulnerable Code Snippet:

python

self.arxiv_url = "http://export.arxiv.org/api/query"

python

response = requests.get(
    self.arxiv_url,
    params=params,
    headers=self.headers,
    timeout=30
)
response.raise_for_status()
papers = self._parse_arxiv_xml(response.text)

Technical Analysis

The arXiv API endpoint uses unencrypted HTTP. Consequently, neither the confidentiality of search queries nor the authenticity and integrity of returned Atom XML metadata are protected in transit.

An attacker with a network interception position could read the user's research query or modify titles, abstracts, author information, categories, record identifiers, and PDF links. The application parses the response without an independent authenticity check and later incorporates these values into the generated Markdown report.

Although the response is treated as data rather than executable code, attacker-controlled URLs and misleading research content can be presented to the user as legitimate arXiv information.

Attack Path

1. A user invokes the script with a research query.
2. The script sends the query to http://export.arxiv.org/api/query.
3. An attacker able to intercept network traffic observes or modifies the HTTP response.
4. The attacker supplies syntactically valid Atom XML containing manipulated metadata or links.
5. _parse_arxiv_xml accepts the modified response.
6. ReviewGenerator.generate embeds the manipulated values and PDF links into the generated report.
7. The user may rely on false research information or follow an attacker-controlled link.

Impact Assessment

Exploitation does not directly grant local code execution or elevated operating-system privileges. Its scope inc ...[truncated 273 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the endpoint with https://export.arxiv.org/api/query.
2. Reject redirects that downgrade the connection from HTTPS to HTTP.
3. Validate returned record and PDF URLs before placing them in reports:
   • Require the https scheme.
   • Restrict hosts to trusted arXiv domains where appropriate.
   • Reject embedded credentials and malformed URLs.
4. Continue using a finite timeout and add explicit response-size limits to reduce resource-consumption risk.
5. Add a test confirming that all external requests use HTTPS and that HTTP downgrade redirects are rejected.

T08 · Insecure Dependencies

Warning

• Location: package.json:21

Finding

Incorrect and Unbounded Third-Party Dependency Declarations

Content

View full analysis

Vulnerability Details

File Location: package.json, lines 21–24
Vulnerability Type: Unsafe and mismatched dependency configuration
Risk Level: Medium

Complete Vulnerable Code Snippet:

json

"dependencies": {
  "requests": ">=2.31.0",
  "beautifulsoup4": ">=4.12.0"
}

Technical Analysis

The project executable is Python, but requests and beautifulsoup4 are declared as npm dependencies. These declarations do not install the Python packages expected by review_generator.py; instead, an npm client resolves packages with those names from the npm registry.

The dependency ranges are open-ended and no lockfile is present in the audited project. A future package version can therefore be selected without an audited upper bound or integrity lock. In addition, Beautiful Soup is not imported or used by the executable, making it an unnecessary supply-chain dependency.

This configuration expands the installation attack surface while failing to provide a reliable declaration for the Python requests dependency actually imported by the program.

Attack Path

1. An operator assumes package.json contains the project's installation requirements.
2. The operator or an automated deployment system runs npm install.
3. npm resolves packages named requests and beautifulsoup4, including future versions permitted by the open-ended ranges.
4. Unrelated, compromised, or otherwise unsafe npm package content is installed into the environment.
5. Any package installation behavior executes with the permissions of the npm process, while the actual Python dependency may remain unavailable or unmanaged.

This path depends on an operator or automation running npm installation for the project; the audited Python script does not itself invoke npm.

Impact Assessment

The maximum scope is the account and environment running package installation. A malicious dependency with installation-time behavior c ...[truncated 290 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the npm dependency declarations unless the project genuinely includes JavaScript components that require them.
2. Declare Python dependencies in pyproject.toml or requirements.txt.
3. Pin reviewed versions or use constrained compatible ranges with a generated lockfile.
4. Use dependency hashes where supported to verify downloaded artifacts.
5. Remove Beautiful Soup because it is unused, or document and import it only if functionality genuinely requires it.
6. Run dependency vulnerability and provenance checks in continuous integration.
7. Document the supported installation command so operators do not mistakenly use npm for Python dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manual trigger phrases are broad natural-language requests such as asking for a literature review or paper-background iteration, without a clearly bounded invocation format. In an agent environment, this increases the chance of accidental or context-triggered activation, causing the skill to run when the user did not explicitly intend to invoke it and potentially initiating external retrieval or draft generation actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language description is entirely in Chinese, which signals a language-specific skill presentation without any indication that users can opt into another language or locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description states the skill generates literature reviews in Chinese and SCI-style output, and the user-facing CLI messages throughout the file are exclusively in Chinese. This creates a locale/language constraint without any opt-in or documented justification, which matches the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level documentation says the skill retrieves papers from multiple sources '(arXiv/PubMed/Google Scholar)'. In implementation, the only search method is search_arxiv, and main() invokes only that method, so the documented capability materially overstates what the code does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions, trigger examples, and output expectations are presented exclusively in Chinese, which can imply a forced language/locale for the skill. The file does not state that Chinese is optional, user-selectable, or required for a specific regional/compliance reason.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: beautifulsoup4 has 1 known advisory(ies) (MAL-2025-3615 (Malicious code in beautifulsoup4 (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest allows any beautifulsoup4 version >=4.12.0, so dependency resolution may install a later compromised or malicious release if the registry package is affected. Because this skill appears to automate external content retrieval and parsing, a malicious parser dependency could execute attacker-controlled code paths or tamper with processed research content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code writes a generated review to a local .md file when the --save argument is present, but there is no explicit warning in comments, docstrings, or before execution that a filesystem write will occur. Because this is a code file, file writes should have some visible disclosure unless clearly documented as expected behavior.

Content

No source excerpt is available for this finding.