Research Paper Compare

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:27 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward paper-comparison guide that asks the agent to retrieve and read research PDFs, with no hidden execution, persistence, or unrelated data access.

Install only if you are comfortable with the agent using web search, opening paper links, retrieving PDFs, and reading PDFs you provide. Prefer trusted scholarly sources such as arXiv, OpenReview, ACL Anthology, publisher pages, or uploaded files, and avoid asking it to fetch unknown or private-network URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: input-handling.md:35

Finding

Unrestricted Retrieval of User-Controlled URLs

Content

View full analysis

Vulnerability Details

File Location: input-handling.md:9-11, 35-40
Vulnerability Type: Server-Side Request Forgery (SSRF) through unrestricted URL retrieval
Risk Level: Medium

Vulnerable Code Snippet

markdown

- Paper titles
- Paper URLs
- Uploaded PDF files

markdown

#### If the input is a URL

1. Inspect whether the URL is already a PDF.
2. If not, identify the paper landing page and locate the PDF link.
3. Verify title, venue, and year when possible.
4. Retrieve the PDF full text.

Technical Analysis

The skill instructs the agent to inspect user-supplied URLs and retrieve either the original resource or a PDF link discovered on the landing page. It does not define controls for:

• Allowed URL schemes or destination domains
• Localhost, private, link-local, reserved, or cloud metadata addresses
• DNS rebinding and destination validation
• Redirect-chain validation
• Embedded URL credentials
• Response size, timeout, and redirect limits
• MIME type and PDF signature verification

If the executing agent has network access, an attacker can provide a URL that resolves or redirects to a service that is inaccessible from the attacker’s own network position. Validation must occur after DNS resolution and after every redirect because a syntactically acceptable public URL can ultimately resolve or redirect to an internal address.

Attack Path

1. An attacker submits a URL and identifies it as a research paper or paper landing page.
2. The skill instructs the agent to inspect that URL.
3. The URL directly targets, resolves to, or redirects to a loopback, private-network, link-local, or cloud metadata endpoint.
4. The agent retrieves the destination using its own network privileges.
5. The response may be processed as paper content or included in retrieval diagnostics.
6. Internal data may consequently be exposed to the attacker through the agent’s output. A large or non-PDF response could also consume excessive processing re ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only https URLs and reject URL credentials, malformed hosts, alternate numeric IP representations, and non-web schemes.
2. Resolve the hostname before making a request and reject loopback, private, link-local, multicast, reserved, unspecified, and cloud metadata address ranges for both IPv4 and IPv6.
3. Repeat destination resolution and validation after every redirect; do not rely solely on validation of the initial URL.
4. Where practical, restrict retrieval to an allowlist of trusted scholarly repositories and publisher domains.
5. Set strict connection and read timeouts, response-size limits, redirect limits, and decompression limits.
6. Require an expected PDF MIME type and verify the PDF file signature before full processing. Do not trust file extensions or response headers alone.
7. Process downloaded documents with a sandboxed, least-privileged parser that has no unnecessary filesystem or network access.
8. Prevent retrieved content from being treated as agent instructions; handle it strictly as untrusted document data.
9. Require explicit user confirmation before retrieving content from an unrecognized domain.
10. Log blocked destinations and redirect chains without recording credentials, tokens, or sensitive response bodies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly instructs the agent to fetch PDFs from web sources and read local PDF files, but it does not define safety constraints for outbound network access, URL validation, or local file access boundaries. In an agent setting, this can enable unintended retrieval from attacker-controlled URLs or access to sensitive local files if user input is not tightly restricted, even though the feature is part of the intended workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.