Security audit

Ingest Paper

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for saving research materials, but it asks for and uses a site-admin Gitea token where narrower repository permissions should be enough.

Install only if you control the Gitea instance or are comfortable granting this skill a site-admin token. Prefer a dedicated, least-privilege bot token if the system can be changed to support it, review who can access the target Gitea repositories and log.md, and disable or avoid Feishu sync unless the user has opted in to sending metadata there.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This module exposes privileged site-admin functionality to create repositories on behalf of arbitrary users via the Gitea admin API. In a reusable skill with no demonstrated need for global administration, this materially expands blast radius: compromise or misuse of the skill enables cross-user actions rather than limiting operations to the bot's own repositories.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The code maintains a central users.json in a separate system-config repository, giving the skill shared global state about users beyond a narrow per-repo task. Centralized mutable identity mapping increases the consequences of logic bugs or abuse, because tampering can affect all users that depend on that mapping.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module is presented as a read-only knowledge-base reader, but listing can also trigger kb.append_query_log() when --log_question is supplied. This mismatch is security-relevant because callers may treat the tool as side-effect free and unintentionally cause storage of user-supplied data, undermining least surprise, privacy expectations, and auditability.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The script claims to install an 'ingest_paper' skill, but it asks the user to populate a GITEA_ADMIN_TOKEN in .env. That mismatch is suspicious because it requests administrative credentials unrelated to the stated document-ingestion purpose, increasing the risk of overprivileged secret collection or hidden backend behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to fetch external content from arXiv, GitHub, ordinary web pages, and uploaded files, then save derived content into a user knowledge base and optionally sync metadata to Feishu. While these actions are part of the intended workflow, the skill does not require an explicit privacy notice about what data leaves the immediate chat context, which third parties may receive requests, or that uploaded/user-provided content may be persisted and forwarded to external systems.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The module automatically loads and uses an administrative token for API requests, including admin endpoints, without any in-code guardrails, disclosure, or consent flow. In an agent skill context, silent privileged execution is dangerous because downstream callers may invoke powerful actions without understanding that a site-wide credential is being exercised.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: Repository creation and file write operations are performed directly through helper functions with no built-in confirmation, policy check, or user-facing disclosure. In an agent-executed environment, such primitives can be composed into unintended state-changing behavior without clear operator awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: append_query_log stores raw user questions into log.md with only truncation, and there is no redaction, consent, or visibility control in this code path. User prompts can contain sensitive research topics, credentials, personal data, or proprietary information, so persisting them in plain text increases privacy and data exposure risk if the repository or logs are later accessed by others.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: User-provided query text is written to a log during normal operation, but this file shows no user-facing disclosure, consent flow, minimization, or sanitization. Queries often contain sensitive research topics, identifiers, or secrets, so silent retention increases privacy and data-handling risk if logs are later exposed, over-retained, or broadly accessible.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The function records user-supplied questions in plain language to a persistent repository-backed log, which can capture sensitive prompts verbatim. In a knowledge-base assistant context, queries are especially likely to include confidential research details or personal information, so this increases the chance of secondary disclosure through repo access, backups, or audit review.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The code explicitly records natural-language user questions via kb.append_query_log(username, args.log_question), creating a durable record of potentially sensitive free-form content. In a knowledge-base/research context, these questions may contain confidential project details, personal data, or proprietary interests, making retention and possible later disclosure materially risky.

Credential Access

High

Category: Privilege Escalation
Content: echo "[2/3] 检查 .env 配置..." if [ ! -f .env ]; then cp env-example.txt .env echo " 已生成 .env，请编辑填入真实的 GITEA_ADMIN_TOKEN！" else echo " .env 已存在，跳过。"
Confidence: 95% confidence
Finding: .env

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0 pymupdf>=1.24 python-docx>=1.1
Confidence: 96% confidence
Finding: requests>=2.28

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0 pymupdf>=1.24 python-docx>=1.1 openpyxl>=3.1
Confidence: 96% confidence
Finding: python-dotenv>=1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0 pymupdf>=1.24 python-docx>=1.1 openpyxl>=3.1
Confidence: 96% confidence
Finding: pymupdf>=1.24

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0 pymupdf>=1.24 python-docx>=1.1 openpyxl>=3.1
Confidence: 97% confidence
Finding: python-docx>=1.1

Unpinned Dependencies

Low

Category: Supply Chain
Content: python-dotenv>=1.0 pymupdf>=1.24 python-docx>=1.1 openpyxl>=3.1
Confidence: 97% confidence
Finding: openpyxl>=3.1

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 73% confidence
Finding: python-dotenv

Known Vulnerable Dependency: pymupdf — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

Category: Supply Chain
Confidence: 72% confidence
Finding: pymupdf

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: python-docx

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: openpyxl

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.