arxiv watcher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 1.0.0

Overview

This skill is a small ArXiv search helper with disclosed research-log persistence, but users should understand it will automatically save paper summaries long term.

Install only if you are comfortable with the agent keeping a persistent research log of papers it discusses. For sensitive research topics, ask the agent not to write memory or review/delete memory/RESEARCH_LOG.md after use; the script should also be hardened with URL encoding and a bounded result count.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:13
• Finding: Untrusted ArXiv content is automatically persisted to long-term Agent memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-30 **Vulnerability Type**: Persistent storage of untrusted remote content **Risk Level**: Medium ### Vulnerable Code ```markdown - **Save to Memory**: Automatically record summarized papers to `memory/RESEARCH_LOG.md` for long-term tracking. - **Deep Dive**: Use `web_fetch` on the PDF link to extract more details if requested. ## Workflow 1. Use `scripts/search_arxiv.sh "<query>"` to get the XML results. 2. Parse the XML (look for `<entry>`, `<title>`, `<summary>`, and `<link title="pdf">`). 3. Present the findings to the user. 4. **MANDATORY**: Append the title, authors, date, and summary of any paper discussed to `memory/RESEARCH_LOG.md`. Use the format: ```markdown ### [YYYY-MM-DD] TITLE_OF_PAPER - **Authors**: Author List - **Link**: ArXiv Link - **Summary**: Brief summary of the paper and its relevance. ``` ``` ### Technical Analysis Paper titles, author fields, abstracts, and PDF contents are obtained from external sources and can contain attacker-controlled text. The workflow requires the Agent to process that content and persist a derived version of it in `memory/RESEARCH_LOG.md`, without requiring user approval or defining sanitization and trust-boundary controls. If persistent memory is subsequently loaded into an Agent context and treated as trusted instructions rather than inert research data, instruction-like material originating from a malicious paper could influence later sessions. Summarization may reduce this risk, but the Skill does not require the Agent to remove embedded directives or prevent them from being reproduced in the stored summary. ### Attack Path 1. An attacker publishes or controls an ArXiv submission containing instruction-like text in its title, abstract, author metadata, or PDF. 2. A user searches for a topic that causes the malicious submission to appear in the API results. 3. The Agent parses or fetches the attacker-controlle ...[truncated 727 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all ArXiv API fields and PDF contents as untrusted data, never as Agent instructions. 2. Require explicit user confirmation before adding externally derived material to persistent memory. 3. Store research records in a structured data format with clearly delimited fields rather than mixing them with instruction-bearing context. 4. Sanitize or escape titles, authors, abstracts, and summaries before persistence, including instruction-like directives and markup capable of changing context interpretation. 5. Ensure that later memory-loading logic presents these records inside an explicitly untrusted data boundary. 6. Record source provenance and distinguish verbatim remote content from Agent-generated summaries. 7. Apply length limits to persisted fields and avoid storing unnecessary PDF text. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search_arxiv.sh:1
• Finding: Unvalidated arguments permit ArXiv API query-parameter injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_arxiv.sh`, lines 1-6 **Vulnerability Type**: Improper URL construction and missing input validation **Risk Level**: Low ### Vulnerable Code ```bash #!/usr/bin/env bash # scripts/search_arxiv.sh QUERY=$1 COUNT=${2:-5} # Use curl to query ArXiv API curl -sL "https://export.arxiv.org/api/query?search_query=all:$QUERY&start=0&max_results=$COUNT&sortBy=submittedDate&sortOrder=descending" ``` ### Technical Analysis The script directly interpolates `QUERY` and `COUNT` into a URL query string without URL encoding or validation. Because the completed URL is enclosed in shell quotes, the shown code does not provide shell command injection. However, reserved URL characters such as `&`, `#`, `=`, and `?` can alter the structure or interpretation of the HTTP request. In particular, an input containing `&parameter=value` can introduce additional ArXiv API parameters. An unbounded or manipulated `COUNT` can also request an unexpectedly large result set, subject to the remote service's limits and parameter-precedence behavior. ### Attack Path 1. An attacker supplies or persuades a user or Agent to invoke the script with a crafted query or count, such as a value containing `&max_results=...` or other ArXiv API parameters. 2. The script inserts the value into the URL without percent-encoding it. 3. `curl` sends a request whose parameter structure differs from the intended fixed request. 4. The remote API may return altered, excessive, or attacker-selected results, depending on how it resolves duplicate and injected parameters. 5. The Agent then processes the manipulated response as ordinary search output. ### Impact Assessment The issue can manipulate outbound ArXiv search requests and may increase response size or resource consumption. It can also influence the records presented to the Agent. It does not, in the shown implementation, enable local shell command execution or grant additional system priv ...[truncated 168 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Construct the request with `curl --get` and encode each parameter independently: ```bash #!/usr/bin/env bash set -euo pipefail QUERY=${1:?Usage: search_arxiv.sh QUERY [COUNT]} COUNT=${2:-5} if ! [[ "$COUNT" =~ ^[0-9]+$ ]] || (( COUNT < 1 || COUNT > 100 )); then printf '%s\n' 'COUNT must be an integer between 1 and 100.' >&2 exit 2 fi curl --silent --show-error --fail \ --location --max-redirs 3 \ --connect-timeout 10 --max-time 30 \ --get 'https://export.arxiv.org/api/query' \ --data-urlencode "search_query=all:$QUERY" \ --data-urlencode 'start=0' \ --data-urlencode "max_results=$COUNT" \ --data-urlencode 'sortBy=submittedDate' \ --data-urlencode 'sortOrder=descending' ``` 2. Enforce a conservative upper bound on `COUNT`. 3. Enable HTTP failure reporting and connection/runtime limits. 4. Limit redirects to reduce unexpected network behavior. 5. Validate that the response has the expected Atom/XML content type and size before passing it to the Agent. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes a shell script (`scripts/search_arxiv.sh`) but does not declare any tool scope or allowed tools. This creates an authorization and review gap: an agent may execute shell-capable behavior that is not explicitly disclosed, making it harder to enforce least privilege and easier for a modified script to perform unintended local actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that summarized papers are automatically saved to `memory/RESEARCH_LOG.md` without warning the user that data will persist beyond the current interaction. Undisclosed persistence is risky because user queries, research interests, or sensitive topics may be recorded unexpectedly and later surfaced to other workflows or sessions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow makes persistence mandatory for any discussed paper, directing the agent to append titles, authors, dates, links, and summaries to a memory file without disclosure or consent. Because this is framed as mandatory behavior, it increases the chance of systematic collection of user-related research activity and creates unnecessary retention of potentially sensitive contextual data.

Static analysis

No suspicious patterns detected.