Security audit

paper-report

Security checks across malware telemetry and agentic risk

Overview

The skill matches its paper-report purpose, but its Word-output path can run shell commands and globally install Node packages, which warrants review before installation.

Install only if you are comfortable with the skill downloading paper content and figures, writing report artifacts into the workspace, and, for DOCX output, potentially modifying the host with global npm or pip packages. Prefer HTML or Markdown output, or preinstall DOCX dependencies in a controlled environment before using the Word workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs use of file reads/writes and outbound network access (for local PDFs, figure extraction, and curl to arXiv), yet no permissions are declared. This creates a mismatch between what reviewers/users may expect and what the skill can actually do, increasing the risk of unintended file access, overwriting local content, or unreviewed network retrieval in an agent runtime.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code invokes a shell command (`execSync('npm root -g')`) during module initialization to discover a global install path. Even though the command string is static, shell execution increases attack surface because it depends on the runtime environment's PATH and shell resolution; a compromised or untrusted environment could cause execution of a malicious `npm` binary or unexpected behavior. In this skill context, the risk is somewhat elevated because the file may run automatically as part of document generation rather than only in a controlled developer setup.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to run shell commands and even install a global npm package (`npm install -g docx`) as part of report generation. That expands the skill from document formatting into environment modification and package execution, creating supply-chain and host-integrity risk if an agent follows it automatically. In the context of a paper-to-report skill, this behavior is not essential and therefore is more suspicious and less justified.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation description is broad enough to trigger on generic requests like 'summarize', 'read', or 'analyze' a paper, which can cause the skill to activate in situations where the user did not explicitly ask for this workflow. Over-broad activation is dangerous because it can unnecessarily pull in file/network-capable behavior and produce outputs in a fixed workflow the user may not want.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill description mandates Chinese output regardless of user preference. While not a code-execution issue, it can override user intent and lead to incorrect or unusable results, especially if the surrounding task, compliance context, or downstream tooling expects another language.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The body of the skill reinforces a Chinese-only output requirement ('全文中文'), removing user choice at execution time. This makes the issue more concrete than the metadata alone because the workflow instruction compels the agent to ignore a user's preferred language unless separately overridden.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The instructions direct the agent to fetch remote HTML content with curl and write it into the local workspace, but they do not require any user-facing disclosure or confirmation before performing outbound network access and local file creation. In this skill's context, remote retrieval is expected functionality for arXiv HTML processing, so the risk is limited, but it still creates transparency and consent issues and could surprise users in restricted environments.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: This step instructs the agent to perform additional network requests for figure URLs and save files into a figures directory without clearly warning the user that more external resources will be fetched and stored locally. Although downloading figures is aligned with the skill's purpose of producing reports with original figures, the undisclosed extra requests expand the skill's network and filesystem side effects.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: writer/docx-template.js:27