Security audit

多论文创新点对比

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its paper-comparison purpose, but it includes under-scoped persistence/self-modification instructions and a script boundary issue that can read files outside the chosen paper folder through symlinks.

Review before installing. Use this only on trusted paper folders, avoid folders containing symlinks, and expect it to create or update summ.md, paper_summ_state.json, and extracted_text. Do not allow the diary or SKILL.md PR self-evolution steps unless you explicitly want persistent changes to the skill and will review them manually.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:117
Finding: Persistent Agent Self-Modification Through Untrusted Execution Feedback
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/paper_summ.py:68
Finding: Paper-Folder Boundary Bypass Through Symbolic Links
Content: View full analysis
str: suffix = path.suffix.lower() if suffix == ".pdf": return extract_pdf(path) return path.read_text(encoding="utf-8", errors="replace") def discover(folder: Path) -> list[Path]: files = [p for p in folder.iterdir() if p.is_file() and p.suffix.lower() in SUPPORTED] return sorted(files, key=lambda p: p.name.lower()) ``` ```python papers = discover(folder) if len(papers) > 20: raise SystemExit(f"Found {len(papers)} supported papers; maximum is 20.") if not papers: raise SystemExit(f"No supported paper files found in: {folder}") text_dir = out_dir / "extracted_text" text_dir.mkdir(parents=True, exist_ok=True) paper_items = [] for index, paper in enumerate(papers, start=1): paper_id = f"P{index:03d}" extracted_path = text_dir / f"{paper_id}_{safe_stem(paper)}.txt" text = extract_file(paper) ``` ### Technical Analysis `Path.is_file()` follows symbolic links. The discovery logic therefore accepts a symbolic link when its target is a regular file and the link name has a supported extension such as `.txt`, `.md`, or `.pdf`. The subsequent `read_text()` and PDF-reader operations also follow the symbolic link. The code does not resolve each candidate and verify that the resolved target remains inside the user-selected paper folder. Consequently, a folder that appears to contain only paper files can cause the script to read any file accessible to the current process. The resulting content is copied into `extracted_text/`, recorded in the state file, and intended to be opened and summarized by the Agent. This expands access beyond the folder boundary represented to the user. ### Attack Path 1. An attack ...[truncated 1313 chars]
Remediation: View remediation
list[Path]: root = folder.resolve(strict=True) files = [] for candidate in folder.iterdir(): if candidate.is_symlink(): continue if not candidate.is_file(): continue if candidate.suffix.lower() not in SUPPORTED: continue resolved = candidate.resolve(strict=True) if not resolved.is_relative_to(root): continue files.append(resolved) return sorted(files, key=lambda p: p.name.lower()) ``` 2. Repeat the containment check immediately before opening each file to reduce time-of-check/time-of-use exposure. 3. Where supported, open files using no-follow semantics such as `O_NOFOLLOW`, then validate the opened file descriptor rather than relying only on pathname checks. 4. Reject non-regular files, including devices, FIFOs, sockets, and directory links. 5. Document that the input folder must not contain links and report rejected entries to the user. 6. Apply equivalent containment validation to a separately supplied output directory and avoid writing output through pre-existing symbolic links. 7. Run the script with a minimally privileged account that cannot read unrelated secrets. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill directs the agent to read and write files and to execute a bundled script, but it declares no explicit tool or permission scope. That creates an authorization ambiguity where an agent may perform filesystem modifications without a clear least-privilege boundary or user-visible consent model.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The self-evolution section instructs the agent to append to diary logs and submit a PR modifying SKILL.md, which exceeds the stated paper-comparison purpose and introduces persistent repository changes. This can be exploited to cause unauthorized self-modification, alter future behavior, or create a covert persistence channel in the repo.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These instructions tell the agent to append to diary files and modify SKILL.md via PRs without any user opt-in, causing persistent changes outside the task's output scope. Such behavior is dangerous because it can mutate repository state, introduce unreviewed prompt changes, and persist data unrelated to the user's immediate request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default prompt is broad and underspecified: it tells the agent to use the skill to compare papers in a folder and produce a summary document, but it does not define activation boundaries, file scope limits, or safety constraints for what may be read and synthesized. In an agent setting, ambiguous triggering can cause overbroad data access or unintended invocation on unrelated folder contents, which increases the risk of confidentiality leakage or misuse of adjacent files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the final summ.md should preferentially be written in Chinese unless the user requests another language. This imposes a language default on users rather than offering a neutral choice or requiring explicit opt-in, which matches the locale/language policy concern for natural-language instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs writing summ.md, state, and extracted text directly into the user's paper folder without clearly warning that existing data may be modified or cluttered. While aligned with the task, silent writes to user directories can still cause accidental overwrites, confusion, or unwanted repository changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction 'Prefer Chinese output unless the user asks for another language' creates a default locale/language constraint rather than asking the user for their preference first. The policy allows language constraints when the user is given a choice or explicitly opts in, which is not the case here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The display name and description are in Chinese while the default prompt is in English, implying a language expectation without documenting user choice or locale handling. This may create an implicit language policy or inconsistent user experience without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.