Security audit

论文关键词搜索和自动下载到指定目录 Keyword search for papers and automatic download！

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to download arXiv papers, but its downloader can fetch unverified links and lacks resource limits, so users should review it before use.

Install only if you are comfortable with a script that performs outbound web requests and writes downloaded files locally. Keep max-results small, use a confined output directory, and prefer a revised version that allowlists arXiv PDF hosts, validates redirects and PDF content, and enforces file-size and batch-size limits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_arxiv.py:160
Finding: Unrestricted Feed-Provided PDF URLs Permit Arbitrary Outbound Requests
Content: View full analysis
None: req = urllib.request.Request(url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}) try: with urllib.request.urlopen(req, timeout=timeout, context=_SSL_CONTEXT) as resp: data = resp.read() except urllib.error.URLError as err: _raise_if_bad_cert(err) raise destination.write_bytes(data) ``` ```python pdf_url = entry.get("pdf_url") if not pdf_url: skipped += 1 print(f"[{idx}/{len(entries)}] SKIP no PDF URL: {title}") continue try: download_file(pdf_url, destination) downloaded += 1 print(f"[{idx}/{len(entries)}] DOWNLOADED: {destination.name}") ``` ### Technical Analysis The Atom feed parser treats any link labeled as a PDF, or having the `application/pdf` media type, as a trusted download location. The URL is passed directly to `urllib.request.urlopen` without validating: - The URL scheme - The destination hostname - The destination port - Embedded credentials - Redirect targets - Whether the response is actually a PDF Although the initial API request uses HTTPS with certificate verification, this protection does not establish that every URL contained in the API response points to an approved ...[truncated 1833 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_arxiv.py:112
Finding: Unbounded Response Reads and Result Count Can Exhaust Local Resources
Content: View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}) for attempt in range(4): try: with urllib.request.urlopen(req, timeout=timeout, context=_SSL_CONTEXT) as resp: return resp.read().decode("utf-8", errors="replace") ``` ```python def download_file(url: str, destination: Path, timeout: int = 60) -> None: req = urllib.request.Request(url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}) try: with urllib.request.urlopen(req, timeout=timeout, context=_SSL_CONTEXT) as resp: data = resp.read() except urllib.error.URLError as err: _raise_if_bad_cert(err) raise destination.write_bytes(data) ``` ```python if args.max_results <= 0: print("ERROR: --max-results must be > 0", file=sys.stderr) return 2 ``` ### Technical Analysis Both Atom responses and PDF responses are read in full using `resp.read()` without a maximum byte count. PDF data is first retained entirely in memory and then written to disk. The script also verifies only that `--max-results` is positive; it does not impose a safe upper bound. Network timeouts do not limit the total number of bytes read. A server can return a very large body within the timeout window, causing substantial memory use. A large result count can multiply memory, bandwidth, disk, and runtime consumption across many downloads. The feed parser also receives the complete decoded XML document in memory, so an oversized API response can consume memory before XML parsing begins. ### Attack Path 1. A user invokes the script with an excessively large `--max-resul ...[truncated 1111 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to perform network access and write downloaded PDFs to disk, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may execute higher-risk capabilities without explicit governance, review, or least-privilege constraints. In this context, the behavior is expected for the skill’s purpose, but the missing declaration still makes the capability exposure less transparent and harder to control.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.