Paper Kb

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent paper-knowledge-base purpose, but it ships and uses overly powerful remote credentials in unsafe ways that could expose users' private papers or local files.

Do not install this version unless the publisher revokes the exposed Gitea token, removes hardcoded secrets, requires HTTPS, enforces server-side user authorization, restricts PDF uploads to approved user-provided files, and documents exactly what paper and identity data is stored in Gitea and Feishu.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: env-example.txt:1

Finding

Hardcoded Gitea Administrator Credential Distributed with the Skill

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/utils/gitea_client.py:10

Finding

Administrator Token and Private Repository Data Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/ingest_paper.py:271

Finding

Model-Controlled Path Permits Arbitrary Local-File Upload to Gitea

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/query_papers.py:67

Finding

Caller-Supplied Feishu Identifier Used as the Sole Authorization Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_user.py:124

Finding

Sensitive Feishu Identity and Table Metadata Stored in a Shared Gitea Repository

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Dependencies Installed into the Active Python Environment

Content

View full analysis

=2.31.0 python-dotenv>=1.0.0 pymupdf>=1.23.0 ``` ```bash echo "[1/2] Installing Python dependencies..." pip install -r requirements.txt --quiet ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. Installation therefore resolves whatever future compatible release is available from the active pip index at installation time. No lock file, package hash, trusted-index restriction, or isolated virtual environment is used. This does not prove that the listed packages are currently malicious. The weakness is that the reviewed Skill does not determine the exact code that setup will install. A compromised future release, compromised package index, or untrusted index configuration could change installation behavior after the Skill itself has been reviewed. Installing into the active environment can also alter packages used by other applications and increases the impact of dependency conflicts or package compromise. ### Attack Path 1. A user executes `setup.sh`. 2. `pip` consults the environment's configured package index and resolves current versions satisfying the lower bounds. 3. A future compromised release or untrusted index response supplies package artifacts not covered by the Skill review. 4. `pip` installs the package into the active Python environment. 5. Package installation or later import executes attacker-controlled code with the installer or Skill process privileges. ### Impact Assessment The impact depends on the privileges used to run setup. A compromised dependency could potentially: - Execute code during installation or import. - Read local environment variables and credentials. - Modify the active Python environment. - Tamper with PDF parsing o ...[truncated 228 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill presented as a paper knowledge base also carries out administrative repository creation, user checks, and generic repository/file operations, potentially using elevated backend credentials. If the underlying tools are powerful, this creates a serious privilege-transparency problem: a routine content-management workflow can become a path to arbitrary persistent writes or reads in external repositories.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A skill presented as a paper knowledge base also carries out administrative repository creation, user checks, and generic repository/file operations, potentially using elevated backend credentials. If the underlying tools are powerful, this creates a serious privilege-transparency problem: a routine content-management workflow can become a path to arbitrary persistent writes or reads in external repositories.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill presented as a paper knowledge base also carries out administrative repository creation, user checks, and generic repository/file operations, potentially using elevated backend credentials. If the underlying tools are powerful, this creates a serious privilege-transparency problem: a routine content-management workflow can become a path to arbitrary persistent writes or reads in external repositories.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill presented as a paper knowledge base also carries out administrative repository creation, user checks, and generic repository/file operations, potentially using elevated backend credentials. If the underlying tools are powerful, this creates a serious privilege-transparency problem: a routine content-management workflow can become a path to arbitrary persistent writes or reads in external repositories.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This query path discloses feishu_app_token along with repository and table metadata without any demonstrated need for paper lookup. If that token is valid for downstream Feishu access, an attacker who can trigger or observe this action could pivot into the user's external data store or automate unauthorized operations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 8)May include surrounding context.

sh

echo "[1/2] 安装 Python 依赖..."
pip install -r requirements.txt --quiet

echo "[2/2] 创建 .env 文件..."
if [ ! -f .env ]; then
  cp env-example.txt .env
  echo "  已创建 .env，三个变量已预填，可直接使用"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 9)May include surrounding context.

sh

echo "[1/2] 安装 Python 依赖..."
pip install -r requirements.txt --quiet

echo "[2/2] 创建 .env 文件..."
if [ ! -f .env ]; then
  cp env-example.txt .env
  echo "  已创建 .env，三个变量已预填，可直接使用"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 10)May include surrounding context.

sh

echo "[1/2] 安装 Python 依赖..."
pip install -r requirements.txt --quiet

echo "[2/2] 创建 .env 文件..."
if [ ! -f .env ]; then
  cp env-example.txt .env
  echo "  已创建 .env，三个变量已预填，可直接使用"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 13)May include surrounding context.

sh

echo "[1/2] 安装 Python 依赖..."
pip install -r requirements.txt --quiet

echo "[2/2] 创建 .env 文件..."
if [ ! -f .env ]; then
  cp env-example.txt .env
  echo "  已创建 .env，三个变量已预填，可直接使用"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill defines broad behavior that relies on identity data, external network calls, and repository/file operations, but does not declare an explicit tool scope or least-privilege boundary. In practice this increases the blast radius if the skill is mis-invoked or compromised, because it can access environment/network-backed capabilities beyond what the manifest transparently communicates.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The body of the skill includes a user provisioning workflow that is materially broader than the manifest's stated storage/query purpose. This scope expansion is risky because it changes the data collected and the side effects performed, which can bypass user expectations and weaken informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mandates extraction of open_id from session metadata and later collects Gitea username and real name, but provides no privacy notice or consent language before transmitting or storing that identity data. Silent collection and cross-system linkage of identifiers can expose personal data, enable tracking across services, and violate data-minimization expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs users to register on an external Gitea instance and then provisions external repositories and Feishu tables, which is significantly broader than simple paper KB functionality. This creates privacy and security exposure because user data and uploaded research materials are pushed into multiple external systems without a clearly framed trust model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs storage of uploaded PDFs, extracted full text, summaries, and metadata into Gitea and Feishu, but does not warn users that their documents and derived data will be persisted in external services. For research papers and possibly unpublished/internal PDFs, this can create confidentiality and compliance risks if users assume the upload is ephemeral or local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a paper storage/query skill, but the implementation delegates all tool actions by invoking Python scripts through spawnSync. Subprocess execution is a broader execution capability than the stated purpose requires and is not declared in the manifest, even though the scripts may implement legitimate KB features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a research paper knowledge base used for storing and querying academic papers when the user expresses save/query intent. However, the code also exposes an init_user tool that verifies Gitea accounts, creates private repositories and folder structures, and updates Feishu bitable configuration, which is broader account/provisioning behavior not reflected in the manifest description or activation scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language parameter descriptions explicitly require Chinese output, such as a '50字以内中文摘要' and '200-300字中文AI综述'. This imposes a specific language policy in the skill interface without indicating that the user can choose another language or opt in to Chinese-only behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code accepts an arbitrary local pdf_path and opens it for text extraction, which accesses user files on the local system. There is no confirmation prompt or explicit disclosure in this file warning that the skill will read local file contents supplied by path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This action persists paper metadata and optional PDF content to a repository via gitea.upsert_file and gitea.write_json, which can affect user data and transmit content over the network. Aside from internal comments, there is no visible confirmation prompt or user-facing warning explaining that repository writes and uploads will occur.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The save action accepts paper_data['pdf_local_path'] and, if that file exists, reads and uploads it to the user's Gitea repository without verifying that it is the expected paper file or that it originated from the current ingestion flow. In an agent setting, a prompt-injected workflow or compromised upstream component could cause arbitrary local files with a .pdf path to be exfiltrated into remote storage, making this a real arbitrary-file upload/exfiltration risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill for storing and querying academic papers in a personal knowledge base. This script instead performs user onboarding tasks: validating Gitea accounts, creating private repositories, initializing repository structure, and updating Feishu bitable metadata, which are operational/admin functions rather than paper storage or query behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script stores Feishu app token and table identifiers in users.json within a system repository, creating a centralized secret store without any visible encryption, access-control checks, minimization, or rotation handling. In the context of a paper knowledge-base skill, persisting third-party integration tokens is higher risk because compromise of the repo or misconfigured access could expose credentials usable against external Feishu resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code writes Feishu identifiers and the app token directly into users.json with no indication of consent flow, disclosure, retention policy, or protection mechanism in this file. Even if intended for configuration, collecting and persisting credentials without clear user-facing notice and secure handling increases the chance of secret leakage and misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The get_index action returns user repository metadata and Feishu integration details, including feishu_app_token, even though the stated purpose is paper index retrieval. Exposing credentials or sensitive integration identifiers through a read/query path greatly increases the blast radius if the skill is invoked by an unintended caller, logged, or surfaced back to the model/user context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Sensitive user metadata is included in the response payload with no indication of consent gating, purpose limitation, or disclosure to the user. In an agent setting, overbroad response data can be propagated into transcripts, tool outputs, caches, or other components, creating avoidable data exposure beyond the requested paper query.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.