Security audit

arXiv

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed arXiv connector, but its fallback setup tells users or agents to execute mutable remote installer scripts without verification.

Review before installing. Use this skill only if you are comfortable sending arXiv query data through OOMOL and installing/signing into the oo CLI. Avoid pasting confidential, unpublished, proprietary, or identifying research text into searches. Do not run the provided remote installer commands unless you have independently verified the installer source and trust the publisher.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote Shell Script Execution
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:66
Finding: Unverified Remote PowerShell Execution
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:30
Finding: Unnecessary Third-Party Transmission of arXiv Query Data
Content: View full analysis
" --data '' --json ``` ### Technical Analysis The Skill requires every arXiv operation to be routed through an OOMOL connector rather than allowing direct use of the official arXiv API. Connector payloads can contain paper identifiers, search terms, author names, titles, abstracts, categories, or other research-related input. This architecture discloses that OOMOL is used, but it does not provide data-retention terms, privacy controls, payload-minimization rules, or a warning against submitting confidential text. Because the listed arXiv actions are public read operations, introducing an authenticated third-party intermediary is not technically necessary for the declared functionality. The available evidence does not establish that OOMOL misuses or retains this information. The risk is that an additional party necessarily processes the submitted payload and execution metadata, expanding the data-exposure boundary beyond arXiv. ### Attack Path 1. A user asks the agent to search arXiv, potentially using confidential research terms or unreleased abstract text. 2. The Skill instruction prevents direct API use and directs the agent to the OOMOL connector. 3. The agent places the user's terms or text into the `--data` JSON payload. 4. The `oo` CLI transmits the payload to OOMOL for connector ex ...[truncated 699 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). That pattern is dangerous because it executes unaudited code from the network with no integrity verification, making compromise of the hosting site, transport, or script supply chain potentially lead to arbitrary code execution on the host.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use this skill for "ANY arXiv request" and "Whenever a task involves arXiv," which is extremely broad and lacks boundaries or exclusion conditions. Because this is a markdown/manifest file, this wording creates an ambiguous trigger scope that could overlap with casual references to arXiv rather than clearly scoped operational requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.