Security audit

Paperzilla MCP

Security checks for vulnerabilities and agentic risk

Overview

This research-brief plugin clearly discloses its account permissions and keeps scheduling, feedback changes, and paper processing under user control.

Review the connected account and consent permissions, including access to all owned projects and continued access. Keep feedback and paper-generation tools approval-required, and restrict shared-gateway access. Revoke the connection in Paperzilla when finished; uninstalling alone may leave OAuth access active. This review covers the bundled instructions and configuration, not the remote service's implementation or independently verified publisher identity.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skills/paperzilla-mcp-morning-brief/SKILL.md (reported line 42)May include surrounding context.
md
Keep the original request's feeds, interests, date window, format, and schedule preferences in the conversation while sign-in is completed. When the user returns, make a fresh `account_status` call and resume without asking for details already supplied. Do not claim a completed brief or saved schedule while tools are unavailable. Account capabilities declare access; verify public content with an actual digest or paper call when the user asks to test it.