Security audit

Tavily arXiv Paper Fetech

Security checks for vulnerabilities and agentic risk

Overview

The paper lookup workflow is coherent, but the skill asks for much broader command, file, agent, MCP, and web authority than the task requires.

Review before installing. The skill appears intended for arXiv paper lookup, not abuse, but it should ideally run with narrower permissions limited to Tavily, arXiv, the two bundled scripts, and a specific work directory. Treat generated Markdown reports as untrusted if they include titles or metadata from outside sources.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:5
Finding: Excessive Tool Permissions Violate Least-Privilege Boundaries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/jsonl_to_paper_fetch_md.py:13
Finding: Untrusted Content Is Written to Markdown Without Escaping
Content: View full analysis
str: index = obj.get("index", "") title = obj.get("input_title", "").strip() status = obj.get("tavily_status", "") error = obj.get("tavily_error") or "" arxiv_url = (obj.get("arxiv_url") or "").strip() fetch = obj.get("fetch") or {} arxiv_id = "" resolved_title = "" authors = "" abstract = "" if isinstance(fetch, dict): arxiv_id = (fetch.get("arxiv_id") or "").strip() resolved_title = (fetch.get("title") or "").strip() author_list = fetch.get("authors") or [] if isinstance(author_list, list): authors = ", ".join(author_list) abstract = (fetch.get("abstract") or "").strip() lines = [ f"### {index}. {title}", f"- Status: {status}", f"- arXiv URL: {arxiv_url}", f"- arXiv ID: {arxiv_id}", f"- Resolved Title: {resolved_title}", f"- Authors: {authors}", f"- Abstract: {abstract}", ] ``` ### Technical Analysis The report renderer interpolates values from the JSONL input directly into Markdown. The affected fields include user-provided titles and remotely sourced titles, authors, abstracts, URLs, status values, and identifiers. Calling `.strip()` removes only leading and trailing whitespace. It does not escape: - Markdown headings, links, or images. - Embedded newlines. - Raw HTML. - Control characters. - Content that resembles instructions to a downstream AI agent. A crafted field can therefore terminate the intended list item, introduce new report sections, insert deceptive links, or embed externally hosted images. The practical effect depends on the Markdown consumer. A renderer that permits raw HTML or automatically fetches images increases the impact. ### Att ...[truncated 1201 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill metadata and instructions claim a title-to-arXiv resolution workflow using Tavily, but the described implementation depends on local helper scripts and may not actually perform the advertised search-and-resolution behavior. This kind of description-behavior mismatch is dangerous because downstream agents or users may trust the skill to have applied stricter validation, provenance, or coverage than it really does, leading to incorrect results, unsafe automation decisions, or misuse of unvalidated inputs.
Content: No source excerpt is available for this finding.