T01 · Skill Instruction Hijacking
Note
- Location
scripts/literature-review.py:193- Finding
Unconditional Third-Party Promotional Content Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Research Skip
Security checks for vulnerabilities and agentic risk
Overview
This academic research skill does what it says, with some disclosed network use and local caching that users should understand before using it in sensitive environments.
Install only if you are comfortable sending academic search topics, author names, and DOIs to OpenAlex, and DOIs from deep-read requests to Unpaywall. Avoid using the literature-review cache on shared or high-sensitivity systems unless you can tolerate possible local cache tampering; review generated reports because they include a publisher attribution link.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/literature-review.py:22- Finding
Predictable Shared Temporary Cache Permits Cache Poisoning and Symlink Attacks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior does not match the claimed implementation: the skill reportedly uses an additional external service not disclosed and overstates literature-review automation capabilities. Undisclosed outbound requests create data-flow and trust risks, and inflated claims can mislead users into sharing data or relying on outputs under false assumptions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises executable scripts that perform network access and local file read/write behavior, but the manifest does not declare any tool scope or permissions boundary. This weakens reviewability and least-privilege enforcement, making it easier for the skill to be invoked with capabilities the user or host may not expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger language is broad enough that the skill may activate for general research-related requests beyond academic paper search. Over-broad invocation can cause unintended network calls, file writes, or disclosure of user queries to external services when the user did not intend to use this specific skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The deep-read path transmits user-requested paper identifiers and a hardcoded email address to a second external service, Unpaywall, without being clearly disclosed in the skill description. While the shared DOI is usually public metadata and the destination is a legitimate academic API, undisclosed third-party transmission can create privacy, compliance, and trust issues in restricted environments.
- Content
python # Try Unpaywall for better PDF URL try: r = requests.get(f"https://api.unpaywall.org/v2/{paper['doi']}?email={MAILTO}", timeout=10) if r.status_code == 200: up = r.json() best = up.get("best_oa_location") or {}
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill notes that review results may be written to a file and cached locally, but this side effect is not clearly disclosed in the main description or warnings. Hidden persistence increases privacy and data-handling risk, especially if user prompts, research topics, or generated summaries are stored in shared or predictable locations like /tmp.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description presents the skill as using OpenAlex API for academic search and paper retrieval, but the implementation additionally contacts the Unpaywall API to enrich results with PDF URLs. While related to academic paper access, this is still behavior beyond the stated single-API description.
- Content