Paper Engineering Assistant

Security checks across malware telemetry and agentic risk

Overview

This academic-writing skill is coherent and disclosed, but it can create and overwrite local thesis project files, so users should use a dedicated project folder and backups.

Install only if you want an agent to manage a local academic-writing project. Choose a dedicated project directory, use backups or version control, and review changes before allowing body generation or synchronization to replace existing draft files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger examples are broad enough that normal user requests like starting a thesis or processing literature could activate the skill in situations where the user did not intend this specific high-permission workflow. Because the skill has filesystem write and network capabilities, accidental invocation could lead to unwanted file creation, modification, or external downloads in the working directory.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly states that existing files in ./document_body/ may be overwritten, but it does not require an explicit warning, diff review, backup, or user confirmation first. In a writing assistant with recursive synchronization behavior, this creates a substantial risk of destructive data loss, including replacement of manually edited content and propagation of incorrect updates across related files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal