ArXiv Watcher for Music Research

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:59 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent arXiv research helper that discloses its local output files, with minor cautions around persistence and input validation.

Before installing, be aware that this skill is designed to save arXiv search logs and paper lists locally. Use it in a project workspace, avoid sensitive or proprietary query terms if local persistence is a concern, and prefer bounded, simple search counts until the curl helper is hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search_arxiv.sh:3

Finding

Unvalidated Input Is Interpolated into a curl URL

Content

View full analysis

Vulnerability Details

File Location: scripts/search_arxiv.sh, lines 3–6
Vulnerability Type: Improper input validation and unsafe URL construction
Risk Level: Low

bash

QUERY=$1
COUNT=${2:-5}
# Use curl to query ArXiv API
curl -sL "https://export.arxiv.org/api/query?search_query=all:$QUERY&start=0&max_results=$COUNT&sortBy=submittedDate&sortOrder=descending"

Technical Analysis

The script accepts a query and an optional result count, then interpolates both values directly into a URL without validation or URL encoding.

An attacker-controlled QUERY can contain URL query delimiters such as &, allowing additional API parameters to be introduced or existing request semantics to be changed. Curl URL-globbing characters, including braces or brackets, may also cause curl to expand a single apparent URL into multiple requests.

COUNT is not restricted to a bounded positive integer. A malformed or excessive value could alter request semantics, cause failures, or request an unnecessarily large response.

Because the expanded variables remain inside a quoted shell word, ordinary shell metacharacters or command substitutions contained in the variables are not reevaluated as shell syntax. Therefore, the observed code does not establish direct shell-command injection.

Attack Path

1. An attacker or untrusted caller supplies a crafted first argument containing URL delimiters or curl globbing syntax, or supplies an excessive second argument.
2. The script assigns these values to QUERY and COUNT without validation.
3. Both values are embedded unchanged in the curl URL.
4. Curl interprets the resulting URL, potentially sending altered or multiple requests to the hard-coded ArXiv endpoint.
5. The requests may consume excessive bandwidth or processing time, return unintended result sets, or cause the invocation to fail.

Impact Assessment

Exploitation can modify the semantics or amplify the ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

• Validate COUNT as a decimal positive integer and enforce a conservative upper bound.
• Construct query parameters with curl --get and --data-urlencode instead of string interpolation.
• Disable curl URL globbing with --globoff.
• Add connection and total-request timeouts.
• Enforce an acceptable response-size limit in the calling workflow.
• Use strict shell settings and reject missing or malformed arguments.

Example hardened implementation:

bash

#!/usr/bin/env bash
set -euo pipefail

QUERY=${1:?A search query is required}
COUNT=${2:-5}

if [[ ! "$COUNT" =~ ^[0-9]+$ ]] || (( COUNT < 1 || COUNT > 100 )); then
    printf 'COUNT must be an integer between 1 and 100\n' >&2
    exit 2
fi

curl --silent --show-error --location --fail --globoff \
    --connect-timeout 10 \
    --max-time 30 \
    --get 'https://export.arxiv.org/api/query' \
    --data-urlencode "search_query=all:${QUERY}" \
    --data-urlencode 'start=0' \
    --data-urlencode "max_results=${COUNT}" \
    --data-urlencode 'sortBy=submittedDate' \
    --data-urlencode 'sortOrder=descending'

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises shell-style usage and file-writing behavior but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to overbroad execution capability, where the skill may invoke shell or filesystem actions without clear authorization or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill emphasizes comprehensive logging of search activities and results, but it does not disclose to the user that prompts, queries, and returned content may be stored locally. This creates privacy and data-governance risk, especially if research topics, search strategies, or retrieved content are sensitive or proprietary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that it will automatically create local directories and write output files, but it does not warn the user or request consent for modifying the local filesystem. This is risky because it can unexpectedly persist data, overwrite existing research artifacts, or write into sensitive paths if the domain or path components are influenced by user input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.