Security audit
Security checks for vulnerabilities and agentic risk
This skill is a mostly coherent AI paper digest tool with disclosed HuggingFace network access and optional delivery automation, but its documentation overstates some features and users should treat fetched paper content as untrusted.
Install only if you are comfortable with the skill fetching public paper metadata from HuggingFace. Confirm language, timezone, recipient, and schedule before enabling any recurring QQ or Notion delivery, and do not let generated digest text trigger other agent actions without review because paper metadata is external content.
scripts/fetch_papers.py:56Untrusted Remote Paper Metadata Is Propagated Without Output Safety Boundaries
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger list includes broad terms such as papers, trending, and research news, which can cause the skill to activate for generic conversations unrelated to this specific function. Over-broad invocation increases the chance of unintended network access, local file modification for history tracking, and accidental routing of user requests through this skill when another skill or no skill should be used.
Defaulting delivery time to Beijing time and preselecting categories without explicit user opt-in can lead to unwanted scheduling behavior and assumptions about the user's locale or interests. In context, this is primarily a consent and UX safety issue rather than a direct security exploit, but it can still cause unintended automated actions such as scheduled digest delivery at the wrong time.
Preselecting Chinese (zh) as the default output language without requiring an explicit user choice can produce content in a language the user did not intend, which is a form of unintended behavior. In this skill's context the danger is limited, but it can still lead to misdelivery, confusion, or automated digest messages being sent in an unusable language.
The module usage/docs state '--source Data source: hf (HuggingFace), arxiv' and the parser exposes the same choice, implying real support for both sources. In practice, when 'arxiv' is selected the code only prints a note and still fetches HuggingFace papers, so the documentation and interface contradict actual behavior.
The inline comment says requests is preferred because it is 'less suspicious to scanners', but the code simply performs the same outbound HTTP fetch regardless of library choice. This documentation introduces an intent implication of avoiding detection rather than explaining a legitimate implementation reason, which conflicts with the skill's stated paper-fetching purpose.
The formatter switches on lang, but line L173 always emits the Chinese label 机构: regardless of the selected language. This violates the language/locale consistency policy because the skill forces a specific language fragment without user opt-in when --lang en is used.
No suspicious patterns detected.