Security audit

arXiv Research Assistant

Security checks across malware telemetry and agentic risk

Overview

This arXiv skill is coherent and purpose-aligned, with disclosed optional paper tracking and normal local PDF download behavior.

Install if you want arXiv search and optional paper tracking. If you enable MongoDB, use a dedicated low-privilege database and understand that saved paper metadata and reading status will be stored there. Choose the PDF download directory deliberately, and prefer pinned dependency versions for reproducible installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises no explicit permissions while also indicating access to environment-configured resources via MongoDB variables. That creates hidden capability scope: users may invoke a paper-search skill without realizing it can read deployment secrets or connect to external stateful infrastructure, which weakens least-privilege expectations and complicates trust decisions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose focuses on searching, downloading, and summarizing arXiv papers, but the skill also persists reading-list data to MongoDB and uses external database configuration. This mismatch is dangerous because users and reviewers may approve the skill for low-risk research assistance while overlooking data storage, retention, and exfiltration paths introduced by external database operations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill description says it searches, downloads, and summarizes arXiv papers, but the code also initializes MongoDB access and supports persistent storage of paper metadata and reading-list state. This expands the skill’s data handling and external connectivity beyond the declared purpose, which can mislead reviewers and users about what data is stored and where it is sent.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code reads MongoDB connection settings from environment variables and connects to an external database even though the stated skill purpose is arXiv search/download/summarization. Hidden or under-disclosed outbound connectivity increases risk because paper metadata, user activity, or future extensions could be persisted to infrastructure outside the user’s expectation or review scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill can write and update persistent MongoDB records through save and update operations, which is broader than a simple paper retrieval tool. Persistent state changes create privacy and integrity risks if users do not expect their reading history or metadata to be stored, and they enlarge the blast radius of any misuse or compromise.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list contains very generic phrases such as "paper," "find papers," and "literature review," which can match ordinary user conversation and cause the skill to activate unexpectedly. In an agent environment, overbroad activation can route unrelated requests into this skill, increasing the chance of inappropriate tool use, user confusion, or unintended access to external resources.

Unpinned Dependencies

Low

Category: Supply Chain
Content: arxiv>=2.0.0 pymongo>=4.0.0
Confidence: 93% confidence
Finding: arxiv>=2.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: arxiv>=2.0.0 pymongo>=4.0.0
Confidence: 98% confidence
Finding: pymongo>=4.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.