Semantic Paper Radar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:11 AM UTC
• Version: 0.1.0

Overview

This literature-search skill is mostly purpose-aligned, but its optional HTML report can include unsafe unescaped content from user queries or search results.

Install only if you are comfortable sending research queries to arXiv, OpenAlex, and PubMed. Avoid using confidential project names in queries, and avoid --export-html for untrusted topics/results until the HTML escaping and HTTPS issues are fixed; if exporting, write only to a safe workspace path and inspect the file before opening it in a browser.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/paper_radar.py:327

Finding

Unescaped User Input and Remote Metadata in Exported HTML Reports

Content

View full analysis

") out.append(f"{title}") out.append("body{font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Arial,sans-serif;max-width:980px;margin:24px auto;padding:0 16px;line-height:1.6}h1,h2{line-height:1.3}code{background:#f2f2f2;padding:2px 4px;border-radius:4px}a{color:#0969da;text-decoration:none}a:hover{text-decoration:underline}ul{padding-left:22px}.muted{color:#666}") link_pat = re.compile(r"\[([^\]]+)\]\(([^\)]+)\)") def conv_links(t): return link_pat.sub(lambda m: f'{m.group(1)}', t) in_list = False for ln in lines: ln = ln.rstrip() if not ln: if in_list: out.append("") in_list = False continue if ln.startswith("# "): if in_list: out.append(""); in_list=False out.append(f"

{conv_links(ln[2:])}

") elif ln.startswith("## "): if in_list: out.append(""); in_list=False out.append(f"

{conv_links(ln[3:])}

") elif ln.startswith("- "): if not in_list: out.append("

"); in_list=True out.append(f"
• {conv_links(ln[2:])}
") else: if in_list: out.append("

"); in_list=False out.append(f"

{conv_links(ln)}

") if in_list: out.append("") out.append("

Generated by semantic-paper-radar

") out.a ...[truncated 2656 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/paper_radar.py:45

Finding

Research Queries Transmitted to arXiv over Unencrypted HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared skill purpose focuses on literature discovery, but the workflow also writes HTML files to disk and references optional Scholar integration that is not implemented in the provided artifact. This mismatch undermines informed consent and reviewability: users may trigger filesystem side effects or depend on capabilities that were not transparently declared or validated.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- 阅读顺序（先读3篇）
   - 可选下一步（细分子方向）

## Output Rules

- Prefer OpenAlex entries with DOI/citation metadata for "经典" judgement.
- Keep arXiv entries for "最新前沿" and unreviewed but high-momentum work.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs use of networked retrieval and optional HTML export, but it declares no explicit tool scope or permissions. That creates an authorization ambiguity where an agent may invoke broader network or file-write capabilities than a reviewer or user would reasonably expect, increasing the risk of unintended data access or local file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction "Present results in Chinese unless user asked otherwise" imposes a specific language by default. This is a natural-language policy concern because it forces a locale choice unless the user explicitly overrides it, rather than offering a neutral default or opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/paper_radar.py (reported line 95)May include surrounding context.

python

filt.append(f"from_publication_date:{from_year}-01-01")
    filter_part = "&filter=" + urllib.parse.quote(",".join(filt)) if filt else ""
    url = (
        f"https://api.openalex.org/works?search={q}&per-page={max_results}{filter_part}"
        "&sort=relevance_score:desc"
    )
    data = fetch_json(url)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code hardcodes Chinese natural-language strings for paper classification and report generation, such as section titles and reading guidance, regardless of user preference. The policy requires avoiding forced language or locale constraints unless there is explicit opt-in or clear justification, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes semantic literature discovery, recommendations, reading lists, and academic context synthesis across scholarly sources. Writing an HTML report to an arbitrary local path is an extra filesystem-output capability beyond the core retrieval and synthesis behavior, and the manifest does not mention local file generation/export.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code creates and writes an HTML report file when --export-html is used, but there is no inline comment or docstring warning that the skill performs a filesystem write. For code-file warning checks, file writes should have some disclosure unless clearly covered; here the CLI flag implies export, but the safety disclosure is still minimal.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.