Security audit

Academic Paper Summarizer

Security checks for vulnerabilities and agentic risk

Overview

This academic summarization skill saves summaries and prompts locally as documented, with no evidence of hidden execution, credential access, exfiltration, or destructive behavior.

Before installing, confirm you are comfortable with the skill saving both summaries and full prompts under local research directories, and remember that its default output instructions are Chinese-focused unless you modify the template or ask the agent to adapt the language.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest describes an academic paper summarization skill with SOP selection, which implies generating summaries but does not mention persistent storage or filesystem output. The example explicitly saves both generated summaries and the full prompt into organized directories, adding a data persistence behavior beyond the stated description.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. The expected output structure is presented entirely with Chinese headings and labels, which implies the skill should produce Chinese output, but the file does not mention user opt-in or explain a region-specific requirement.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This file contains a natural-language instruction that requires the model to write the analysis in Chinese while only allowing technical terms in English. The policy specifically flags language or locale constraints that are imposed without user opt-in or a clearly documented region-specific justification.

Intent-Code Divergence

Low

Confidence: 79% confidence
Finding: The section heading says 'Generate and Save Summary', which suggests a single output artifact. However, the example code performs an additional write of the full prompt to a separate file, so the documentation understates what is being stored.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The example writes both generated summaries and the full prompt to disk without any warning, consent mechanism, or discussion of retention. Prompt content can contain sensitive paper text, user notes, internal instructions, or proprietary context, so silent persistence increases the risk of unintended local disclosure, forensic recovery, or accidental sharing.

Static analysis

No suspicious patterns detected.