Academic Composer Upload

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:53 PM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for academic research and writing help, but it gives shell command templates that can include user-controlled text and uses a predictable temporary essay file path.

Review before installing. Use this skill only in an isolated environment, avoid pasting sensitive or private essay text unless you understand your agent's LLM data flow, and do not let an agent interpolate raw topics or DOI strings into shell commands. Prefer stdin or safely constructed argument arrays for local analysis instead of /tmp/essay.txt.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Shell Command Injection Through User-Controlled Search Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Predictable Shared Temporary File Exposes Essay Content to Symlink and Race Attacks

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Package and Model Installation Creates Supply-Chain Exposure

Content

View full analysis

=3.7.0 ``` From `README.md:41-42`: ```bash pip install -r requirements.txt python -m spacy download en_core_web_sm ``` From `SECURITY.md:55-58`: ```text spaCy model must be installed manually by the user: ```bash python -m spacy download en_core_web_sm ``` ``` ### Technical Analysis The requirement specifies only a lower bound. As a result, installation can resolve to any future spaCy version accepted by the package resolver. Neither the package nor its transitive dependencies are locked or protected with cryptographic hashes. The separately downloaded `en_core_web_sm` model is also not pinned to a reviewed version or verified against a documented digest. Package and model installation may retrieve externally controlled artifacts and execute package build or installation logic. This does not demonstrate that the current spaCy package is malicious. The vulnerability is the absence of version and integrity controls, which makes installations non-reproducible and increases exposure to compromised releases, dependency takeover, incompatible future versions, or a manipulated package source. ### Attack Path 1. A user follows the documented setup instructions. 2. `pip` resolves `spacy>=3.7.0` and its transitive dependencies from the configured package index. 3. The resolver may select an unreviewed future release because no upper bound, lockfile, or hash is present. 4. The model download command retrieves a model artifact without a project-recorded version or checksum. 5. If a selected package, transitive dependency, model artifact, or configured package source is compromised, malicious installation or runtime code executes under the user's account. 6. The malicious component ...[truncated 807 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill’s activation criteria are broad enough to trigger on routine academic-help requests such as essays, drafts, citations, and source finding, without requiring checks for institutional policy compliance or stronger gating around misuse scenarios. In context, this increases the chance the agent will assist with producing submission-ready academic work that can facilitate plagiarism or circumvention of academic integrity rules despite the disclaimer text.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation logic is broad enough to trigger on many ordinary academic-help requests, including generic citation or paper-writing queries. Because the skill has both shell and network permissions and can autonomously search sources or process content, unintended invocation could cause unnecessary external lookups, unexpected tool use, or generation of high-risk academic-assistance output in contexts where the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains many generic phrases like 'write essay,' 'research paper,' 'academic writing,' and citation-related terms that are common in benign conversation. This raises the chance of accidental activation, which is more concerning here because the skill can use network and shell capabilities and may steer the interaction into full essay generation, source retrieval, or plagiarism-adjacent assistance without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation cues are broad enough to trigger on common academic-writing requests such as essays, citations, and drafts without clearly constraining appropriate use cases. That increases the chance the skill will activate in contexts involving plagiarism, policy evasion, or ghostwriting, especially because it offers end-to-end essay generation rather than narrowly scoped research assistance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code explicitly loads the spaCy model "en_core_web_sm", which constrains analysis to English. This is a natural-language policy concern because the skill enforces a specific language/locale behavior without offering the user a choice or documenting that the tool is intentionally English-only.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill/scripts/pipeline.py (reported line 37)May include surrounding context.

python

f"measure.py not found at {_MEASURE_SCRIPT}. "
            "Ensure the academic-composer skill is installed correctly."
        )
    result = subprocess.run(
        [sys.executable, str(_MEASURE_SCRIPT), "--stdin", "--json"],
        input=essay_text,
        capture_output=True,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill/scripts/scholar.py (reported line 23)May include surrounding context.

python

import urllib.request
from typing import Any, Dict, List, Optional

API_BASE = "https://api.semanticscholar.org/graph/v1"
PAPER_FIELDS = "title,authors,year,abstract,externalIds,venue,referenceCount,citationCount,journal,publicationTypes"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very broad phrases such as 'write essay', 'research assistant', and 'academic writing' that are common user intents and may activate the skill in contexts where the user did not explicitly ask for this specific capability. Over-broad activation increases the chance of unintended routing, inappropriate invocation, or the skill being used in contexts with stricter policy requirements around academic integrity or source handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (spacy>=3.7.0), which allows installation of any newer release, including versions with breaking changes or newly introduced supply-chain risk. While this is not an immediately exploitable flaw by itself, unpinned dependencies reduce build reproducibility and can expose the skill to unexpected or malicious upstream package changes.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

spacy>=3.7.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The file mixes English and Chinese trigger phrases, which may impose language-specific activation behavior without stating whether users can opt in or select their preferred language. Under the language/locale policy, multilingual behavior should be clearly optional or justified rather than silently enabled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.