Mli Paper Reading

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent paper-reading helper, but it needs review because it automatically creates and serves HTML notes and can place untrusted PDF text into browser-rendered HTML without escaping.

Install only if you are comfortable with it writing notes under ~/paper-notes, launching a local web server, and opening a browser. Use caution with PDFs from untrusted sources, and prefer pinning dependencies and escaping or sanitizing all paper-derived text before generating HTML.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Dependencies Permit Mutable Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19, 164, and 283–299
Vulnerability Type: Supply-chain exposure through unpinned Python and CDN dependencies
Risk Level: Medium

Vulnerable Code

bash

python3 -m pip install pymupdf --user

markdown

| **pymupdf** (`import fitz`) | Image extraction (Step 2) | `python3 -m pip install pymupdf --user` | The only package requiring manual installation, version ≥ 1.18 |

html

<script src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js" async></script>
<script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></script>

Technical Analysis

The skill directs users to install PyMuPDF without an exact version or a verified package hash. It also loads Mermaid without a version constraint and MathJax using only a major-version constraint. The external scripts have no Subresource Integrity attributes.

These mutable dependency references allow code obtained during a later invocation to differ from the code that was originally reviewed. If a package release, package-distribution account, CDN, or upstream mutable asset is compromised, the substituted code could execute when the user installs the Python dependency or opens a generated HTML note.

This is a supply-chain weakness rather than evidence that the currently referenced packages are malicious.

Attack Path

1. An attacker compromises a relevant package release, distribution account, CDN asset, or mutable dependency path.
2. The user follows the skill's installation instruction or generates and opens an HTML paper note.
3. Package resolution or the browser retrieves the attacker-controlled dependency version.
4. The Python package executes with the invoking user's privileges during installation or use, or the CDN script executes in the generated note's browser origin.
5. The malicious dependency can access resources available to that user or browser ...[truncated 667 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyMuPDF to a reviewed exact version instead of accepting the latest available release.
2. Use a requirements or lock file with cryptographic hashes, and install with hash verification.
3. Pin MathJax and Mermaid to exact, reviewed artifact versions.
4. Add Subresource Integrity hashes and crossorigin="anonymous" to external script tags.
5. Prefer bundling reviewed copies of browser dependencies locally so generated notes do not execute mutable remote code.
6. Establish a dependency-update process that re-audits and deliberately updates versions and hashes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:203

Finding

Unescaped PDF-Derived Captions Can Inject Active HTML into Generated Notes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 203–204, 231–232, and 265–273
Vulnerability Type: HTML injection caused by unsafe interpolation of untrusted document metadata
Risk Level: Medium

Vulnerable Code

python

text_lines = [l.strip() for l in page.get_text().split('\n')]
captions = [l for l in text_lines if l.lower().startswith('figure')]

python

cap = captions[img_idx] if img_idx < len(captions) else f"Figure (page {pg_num+1})"
figures.append({"label": f"fig_p{pg_num+1}_{img_idx}", "page": pg_num+1,
                "caption": cap, "b64": b64, "w": pix.width, "h": pix.height})

html

<figure style="text-align:center;margin:1.5rem 0;">
  <img src="data:image/png;base64,{b64}"
       style="display:block;max-width:100%;height:auto;margin:0 auto;
              border:1px solid #ddd;border-radius:4px;background:#fff;"
       alt="{caption}">
  <figcaption style="font-size:0.82rem;color:#666;font-style:italic;margin-top:0.4rem;">
    {caption}
  </figcaption>
</figure>

Technical Analysis

Figure captions are extracted from a potentially untrusted PDF and then interpolated into two distinct HTML contexts: a quoted alt attribute and the body of a figcaption element. The documented generation process does not apply HTML escaping or contextual output encoding to the caption.

A malicious caption containing quotation marks and HTML syntax can terminate the alt attribute and introduce new attributes or elements. A caption placed in the element body can directly introduce HTML markup. Because the workflow requires serving and automatically opening the generated document, injected active content can execute when the note is viewed.

The documented safety rule for escaping angle brackets inside LaTeX does not protect these caption insertion points.

Attack Path

1. An attacker creates or supplies a PDF whose extracted figure caption contains an HTM ...[truncated 1078 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all paper-derived text, including captions, titles, authors, abstracts, links, and metadata, as untrusted input.
2. Apply contextual HTML escaping before interpolation. For Python-generated text, use html.escape(value, quote=True) for both attribute and text contexts.
3. Prefer a maintained template engine with automatic escaping enabled instead of manual string concatenation.
4. If limited markup must be supported, sanitize it with a strict allowlist and prohibit scripts, event-handler attributes, dangerous URL schemes, embedded frames, and active SVG content.
5. Add a restrictive Content Security Policy that disallows inline scripts and event handlers. Move required inline initialization into reviewed local scripts or authorize only exact script hashes.
6. Add regression tests using captions containing ", ', <, >, &, closing tags, event-handler payloads, and encoded variants.
7. Avoid automatically opening generated files until validation and sanitization have completed successfully.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises very broad automatic trigger keywords such as 'paper', 'PDF', 'comparison', and 'reproduction', which can cause the skill to activate in contexts the user did not clearly intend. Because this skill writes files, starts a local web server, fetches remote content, and opens a browser, unintended invocation can lead to surprising side effects and expanded attack surface.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

| 依赖 | 用途 | 安装 | 备注 |
|---|---|---|---|
| **Python 3.7+** | 所有步骤 | macOS 内置；Linux: `sudo apt install python3` | `http.server --directory` 需 3.7+ |
| **pymupdf** (`import fitz`) | 图片提取（Step 2） | `python3 -m pip install pymupdf --user` | **唯一需要手动安装的包**，版本 ≥ 1.18 |
| **http.server** | 本地服务（Step 3） | Python 内置，无需安装 | 服务 `~/paper-notes/` |
| **lsof** | 端口检测（Step 3） | macOS 内置；Linux: `sudo apt install lsof` | 不可用时直接用 7410 端口 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

| 依赖 | 用途 | 安装 | 备注 |
|---|---|---|---|
| **Python 3.7+** | 所有步骤 | macOS 内置；Linux: `sudo apt install python3` | `http.server --directory` 需 3.7+ |
| **pymupdf** (`import fitz`) | 图片提取（Step 2） | `python3 -m pip install pymupdf --user` | **唯一需要手动安装的包**，版本 ≥ 1.18 |
| **http.server** | 本地服务（Step 3） | Python 内置，无需安装 | 服务 `~/paper-notes/` |
| **lsof** | 端口检测（Step 3） | macOS 内置；Linux: `sudo apt install lsof` | 不可用时直接用 7410 端口 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

| 依赖 | 用途 | 安装 | 备注 |
|---|---|---|---|
| **Python 3.7+** | 所有步骤 | macOS 内置；Linux: `sudo apt install python3` | `http.server --directory` 需 3.7+ |
| **pymupdf** (`import fitz`) | 图片提取（Step 2） | `python3 -m pip install pymupdf --user` | **唯一需要手动安装的包**，版本 ≥ 1.18 |
| **http.server** | 本地服务（Step 3） | Python 内置，无需安装 | 服务 `~/paper-notes/` |
| **lsof** | 端口检测（Step 3） | macOS 内置；Linux: `sudo apt install lsof` | 不可用时直接用 7410 端口 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

| 依赖 | 用途 | 安装 | 备注 |
|---|---|---|---|
| **Python 3.7+** | 所有步骤 | macOS 内置；Linux: `sudo apt install python3` | `http.server --directory` 需 3.7+ |
| **pymupdf** (`import fitz`) | 图片提取（Step 2） | `python3 -m pip install pymupdf --user` | **唯一需要手动安装的包**，版本 ≥ 1.18 |
| **http.server** | 本地服务（Step 3） | Python 内置，无需安装 | 服务 `~/paper-notes/` |
| **lsof** | 端口检测（Step 3） | macOS 内置；Linux: `sudo apt install lsof` | 不可用时直接用 7410 端口 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates writing HTML to ~/paper-notes, starting a localhost HTTP server, and opening a browser, but the skill description does not prominently warn users about these side effects before execution. Lack of explicit disclosure undermines informed consent and increases the risk of unexpected local state changes or exposure of generated notes via a local service.

Content

No source excerpt is available for this finding.