logseq web article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:11 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for web article archiving, but it tells the agent to automatically install another skill without a pinned source or user approval.

Review this skill before installing. Its article-fetching behavior is understandable, but it should not automatically add logseq-article-archive unless you trust the dependency source and explicitly approve the installation. Prefer a version that asks first and pins the dependency to a verified publisher or immutable release.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unverified Automatic Installation of an Unpinned Skill Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-48; repeated at lines 19 and 58
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippet:

markdown

5. Check if logseq-article-archive skill is installed
6. If logseq-article-archive is not installed, install it automatically

The same behavior is also declared elsewhere in the file:

markdown

4. Check if logseq-article-archive skill is installed; if not, install it automatically

markdown

- This skill requires logseq-article-archive skill for secondary processing. It will be installed automatically if not present.

Technical Analysis

The skill directs the agent to install logseq-article-archive automatically when the dependency is absent. It does not specify a trusted repository, verified publisher, immutable version or commit, cryptographic integrity hash, permission boundary, dependency review process, or explicit user confirmation.

Resolving a dependency solely by its mutable name creates a supply-chain risk. If the configured skill source is compromised, permits dependency confusion, or contains an attacker-controlled package with the same or a deceptively similar identity, the agent may install and invoke untrusted instructions or code. The dependency is subsequently used for article analysis, summarization, and archival, giving it access to the content being processed and any tools made available during execution.

The audit found no evidence that the referenced dependency is currently malicious. The vulnerability is the unsafe, unverified automatic installation mechanism.

Attack Path

1. A user invokes logseq-web-article with an article URL.
2. The agent checks for logseq-article-archive and determines that it is not installed.
3. The skill instructs the agent to resolve and install that dependency automatically.
4. An attacker publishes, replaces, or comprom ...[truncated 1435 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic installation and require explicit, informed user approval before adding any external skill.
2. Resolve the dependency only from a documented, trusted registry or repository and verify the expected publisher identity.
3. Pin the dependency to an immutable version or commit rather than resolving it solely by name.
4. Publish and verify a cryptographic checksum or signed provenance record before installation.
5. Review the dependency's files, instructions, scripts, transitive dependencies, and requested permissions before invocation.
6. Run the dependency with least privilege in an isolated environment, exposing only the article content and tools required for summarization and archival.
7. Disable recursive or automatic installation of additional dependencies unless each component is independently approved and verified.
8. Fail safely when the dependency is absent or cannot be authenticated; provide manual installation instructions instead of silently continuing.
9. Record the verified dependency source, version, integrity value, and granted permissions in an audit log.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly directs automatic installation of a secondary skill if it is not already present, without requiring user confirmation, trust verification, or any warning about the security implications of bringing in new executable skill logic. This creates a supply-chain and privilege-expansion risk: a benign article-fetch workflow can silently pull in additional capabilities whose behavior the user did not approve.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The file includes a full Chinese-language section, but it does not explicitly state that language output is user-selectable or opt-in. This can be read as a locale/language preference baked into the skill documentation rather than a user-driven choice.

Content

No source excerpt is available for this finding.