ars-academic-paper

• Outcome: Review
• Latest audit: Aug 22, 2026 · 12:16 PM UTC
• Version: 3.3.2

Overview

This is a large text-only academic writing workflow with disclosed manuscript editing, formatting, local outputs, and optional external verification, but no artifact-backed deception or malicious behavior.

Install only if you are comfortable giving the skill access to unpublished manuscript text and related academic materials. Review the selected mode before it runs, inspect citation and formatting changes before submission, and do not enable cross-model/API verification unless you explicitly accept sending the described content to that provider. Delete or protect generated local reports and output packages if they contain sensitive work.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (18)

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The manifest describes this agent as a verifier/flagger, but the body instructs it to directly auto-correct and modify draft content. That mismatch can cause unintended write actions, violate least surprise for orchestrators, and let a supposedly read-mostly compliance step alter user content or downstream state without explicit authorization.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The instruction to cross-reference all journal articles against an external retraction database introduces network-dependent behavior unrelated to minimal citation-format checking. If executed in an agentic environment, this can leak sensitive bibliography or manuscript context to third parties, create nondeterministic behavior, and expand the attack surface through unnecessary external lookups.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The phase boundary says the sole deliverable is a citation compliance report, but later sections require a corrected draft and corrected reference list. This contradiction creates ambiguous authority and can let the agent exceed orchestration boundaries, causing unauthorized content mutation or phase bleed into downstream responsibilities.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file declares Phase 7 as 'format-only' but also requires the agent to add substantive manuscript content such as disclosure text and checklist-driven required sections. That scope contradiction can cause unauthorized content changes after review, undermining pipeline guarantees and making downstream trust in 'final reviewed' artifacts unreliable.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The detailed execution algorithm explicitly instructs the formatter to insert an AI disclosure statement and a Limitations section if absent, directly violating the agent's own 'format-only, not content revision' boundary. In a multi-agent pipeline, this creates a hidden write capability in the terminal stage, allowing unreviewed material to be added after peer-review or citation-validation gates.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README explicitly states the skill triggers from natural-language input without commands and lists broad phrases such as general paper-writing requests. In an agent gateway that auto-routes skills based on user text, this can cause overbroad activation, unexpected interception of ordinary requests, and prompt-scope capture beyond what the user intended.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger set includes broad phrases like 'write abstract,' 'convert format,' and 'guide my paper,' increasing the chance that ordinary user requests unintentionally invoke this powerful multi-agent skill. In a skill that can route across drafting, formatting, disclosure, and review behaviors, overbroad activation can cause wrong-mode execution, unnecessary processing of sensitive manuscript content, or generation of outputs the user did not intend to request.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The plan-mode rule says to activate when the user expresses uncertainty and to prefer plan when ambiguous, which biases routing toward a mode without a strong explicit user signal. In practice, this can override user intent, mishandle provided materials, and create integrity risks if content meant for full drafting, revision, or another skill is processed under the wrong workflow assumptions.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The rule requiring unsupported conjecture to be labeled in both English and Chinese imposes output-format and language behavior without explicit user opt-in. While framed as an academic-integrity safeguard rather than a malicious instruction, it can override user preferences, create unnecessary disclosure text, and cause policy or UX conflicts in monolingual workflows.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrase 'Convert citations to [format]' is broad and can activate citation-conversion behavior 'at any point during the pipeline' without clear scoping or confirmation. In context, that increases the risk of the formatter performing substantial transformations outside its normal terminal role, bypassing expected phase controls or surprising the caller with cross-phase actions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The plan-mode trigger relies on broad natural-language phrases like "guide my paper" and "step by step," which can match many ordinary academic-writing requests that were not intended to enter the reduced 3-question flow. In this skill, unintended activation changes workflow, skips normal intake questions, and can cause incomplete configuration or incorrect downstream handoff, making it a genuine control-flow integrity issue even without code execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Operational mode detection maps short phrases such as "Write a paper," "Paper outline," and "Check citations" directly to different pipeline modes without requiring context or confirmation. Because these modes alter required inputs and behavior, ambiguous matching can route users into the wrong workflow, skip safeguards, or apply inappropriate processing to supplied materials.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: Broad triggers like 'help me with my revision' or 'revision roadmap' increase the chance of unintended activation in unrelated contexts, causing the agent to switch into a specialized workflow without sufficient user intent confirmation. In a multi-skill environment, this can misroute sensitive academic content, produce incorrect procedural framing, or bypass the more appropriate skill selection path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The protocol explicitly directs the agent to write compliance reports to a local file during non-pipeline invocation, but the document does not require prior user notice, consent, or retention controls. Because compliance reports may contain manuscript details, rationale text, and audit history, this creates a privacy and data-persistence risk through unexpected local storage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The schema explicitly supports privacy-sensitive and externally retrievable pointers such as file://, obsidian://, zotero://, and DOI/HTTPS links, while also noting that downstream consumers may fetch content from them. Although this schema does not itself dereference pointers, documenting and normalizing these fields without stronger top-level privacy and trust-boundary guidance can lead downstream components to expose local paths, vault structure, or fetch attacker-controlled URIs, increasing data leakage and SSRF-like risk in the broader skill pipeline.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The clarification template hard-codes Chinese wording such as `模式` and `对应模式 equivalent` in user-facing response examples without a language-selection rule. In an academic writing skill serving multilingual users, this can cause unintended language switching, user confusion, and prompt behavior that ignores the user's requested language, though it is not a severe security issue.

External Transmission

Medium

• Category: Data Exfiltration

Content

endpoint="${ARS_OPENAI_COMPAT_BASE_URL%/}/chat/completions"
GUARD=the cross-model verification module

resp="$(curl -sS -w '\n%{http_code}' "$endpoint" \
  -H "Authorization: Bearer $ARS_OPENAI_COMPAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg model "$ARS_CROSS_MODEL" --arg prompt "$PROMPT" '{

• Confidence: 91% confidence
• Finding: This section documents sending model prompts and citation context to an arbitrary OpenAI-compatible endpoint controlled by `ARS_OPENAI_COMPAT_BASE_URL`. Although the file warns about consent and dedicated credentials, a misconfigured or malicious endpoint could receive unpublished manuscript content, reviewer material, or other sensitive academic data, creating a real exfiltration/privacy risk.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

"$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/evidence/evidence_row_v1_2.schema.json",
  "title": "ARS Shared Evidence Row v1.2 — cross-document consistency",
  "description": "Closed observation-level evidence-row/1.2 carrier for the cross-document consistency advisory. One row integrity-binds the complete ordered bilateral or preregistration three-witness evidence set. Evidence and checked-scope states are caller-supplied semantic observations whose bytes are replayed; they are not agreement, completeness, readiness, acceptance, or authorization findings.",
  "type": "object",
  "additionalProperties": false,
  "required": [

• Confidence: 95% confidence
• Finding: The schema contains a bidirectional/invisible Unicode control character pattern in the relative_path validation block, which is a known metadata/tooling poisoning risk because such characters can make displayed content differ from the actual bytes parsed by downstream agents or reviewers. In an agent skill context, especially one built around contracts and evidence handling, this can enable deceptive schema text, hidden path semantics, or reviewer/tool confusion even if it does not directly execute code.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:238