T01 · Skill Instruction Hijacking
Warning
- Location
scripts/fetch_papers.py:83- Finding
Untrusted Paper Metadata Can Inject Instructions into the Agent Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Paper Assistant
Security checks for vulnerabilities and agentic risk
Overview
This skill fetches public paper metadata, asks the agent to recommend a paper, and keeps a small local record of pushed paper IDs; the behavior is disclosed and proportionate, with a prompt-injection caution for untrusted paper text.
Before installing, be aware that the skill contacts OpenReview and arXiv, reads public paper metadata into the agent context, and updates data/pushed.json to avoid repeats. It is reasonable to install for this workflow, but users should add or follow a rule that paper titles, abstracts, authors, and URLs are untrusted content and should not be treated as instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向论文检索、筛选与推荐的技能，重点在于发现和挑选最新论文；而实际代码只是一个本地维护脚本，把给定的 paper_id 追加到 pushed.json 里，避免重复推送。它既不访问论文数据源，也不进行任何检索、排序、推荐或强化学习/Agent 方向分析。虽然“用于后续推送”与“标记已推送”在工作流上有关联，但该代码块本身的主要目的与声明的核心能力明显不一致，因此应判定为描述与行为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill invokes network access to fetch papers and writes local state to data/pushed.json, but it declares no permissions or allowed-tools scope. This creates an under-specified trust boundary: an agent may be granted broader file or network capabilities than users expect, increasing the risk of unintended external requests or local file modification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written as a directive in Chinese and the rest of the skill content consistently specifies behavior and outputs in Chinese, with no indication that users may choose another language. This creates a locale/language policy concern because the skill appears to assume a fixed language without user opt-in or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to append IDs to data/pushed.json and even create the file if missing, without clearly warning the user that local files will be modified. Hidden state changes can affect reproducibility, surprise users, and become dangerous when chained in automated pipelines because the agent silently persists data across runs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a skill for finding, filtering, or recommending recent papers for later reading or pushing, but this script mutates local state by creating and updating data/pushed.json. Persistently marking items as already pushed is a state-management behavior not reflected in the manifest’s stated functionality.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring describes the skill entirely in Chinese, indicating a fixed language presentation for the skill's user-facing description. There is no indication of user opt-in, language selection, or a documented region-specific reason for restricting the skill to Chinese.
- Content