论文复现执行器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for paper-reproduction work, but it needs Review because crafted paper metadata can be written into generated Python code and clone paths can escape the intended workspace.

Install only after review or in a sandboxed workspace. Fix path sanitization to reject separators and traversal, generate Python/YAML with safe serialization or repr, and avoid running generated projects or loading checkpoints from untrusted papers until those issues are addressed. Expect the skill to use Chinese output, inspect local workspace paths, clone selected official or possibly official repositories, and write reports/scaffolds locally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bootstrap_repo.py:33

Finding

Workspace Path Traversal Through Unsafely Sanitized Path Components

Content

View full analysis

Vulnerability Details

File Location: scripts/bootstrap_repo.py:33-39, 130-136
Vulnerability Type: Path traversal and unrestricted filesystem write
Risk Level: Medium

Vulnerable Code

python

def safe_component(value: str, default: str = "paper") -> str:
    value = value.lower().replace("\\", "/")
    value = re.sub(r"[^a-z0-9._/-]+", "-", value)
    value = re.sub(r"/{2,}", "/", value).strip("/")
    value = re.sub(r"(^|/)-+", r"\1", value)
    value = re.sub(r"-+(/|$)", r"\1", value)
    return value or default

python

safe_slug = safe_component(args.paper_slug, "paper")
safe_bucket = safe_component(args.bucket, "main-code")
root_dir = Path("paper-repro-workspace") / safe_slug / safe_bucket
root_dir.mkdir(parents=True, exist_ok=True)

repo_name = repo_name_from_url(repo_url)
target_dir = root_dir / repo_name

Technical Analysis

safe_component() permits forward slashes and periods, including the special path component ... Although backslashes are normalized and some characters are removed, the function does not reject absolute paths or traversal components.

The resulting values are appended directly to paper-repro-workspace. Python's path handling resolves embedded .. components when filesystem operations are performed. A value such as ../../outside can therefore cause root_dir.mkdir() and the later git clone destination to escape the intended workspace.

The repository name is sanitized separately, but this does not mitigate traversal through paper_slug or bucket.

Attack Path

1. An attacker influences the paper_slug or bucket argument supplied to bootstrap_repo.py.
2. The attacker supplies a value containing traversal components, such as ../../outside.
3. safe_component() retains the periods and path separators.
4. root_dir resolves outside paper-repro-workspace.
5. The script creates directories at the escaped location.

...[truncated 664 chars]

Remediation

View remediation

Remediation Suggestions

• Treat paper_slug and bucket as single path components and reject all / and \ characters.

• Explicitly reject empty components, ., and ...

• Reject absolute paths before constructing the destination.

• Resolve both the workspace and destination, then verify containment:

  python

  workspace = Path("paper-repro-workspace").resolve()
  target = (workspace / safe_slug / safe_bucket / repo_name).resolve()
  
  if target != workspace and workspace not in target.parents:
      raise ValueError("Destination escapes the workspace")
  

• Prefer a sanitizer that only permits letters, digits, underscores, periods, and hyphens, without path separators.

• Add tests for .., ../x, a/../../x, absolute paths, Windows drive paths, and mixed slash forms.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scaffold_repro_project.py:75

Finding

Python Code Injection in Generated Scaffold Through Unescaped Paper Metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/build_paper_spec.py:23-29, 50-65; scripts/scaffold_repro_project.py:75-78, 176-181
Vulnerability Type: Generated source-code injection
Risk Level: High

Vulnerable Code

The title is inferred from attacker-influenced evidence text and inserted into a YAML-like document without serialization:

python

def infer_title(text: str) -> str:
    for line in text.splitlines()[:80]:
        clean = line.strip().strip("# ")
        if 8 <= len(clean) <= 180 and not clean.lower().startswith(("abstract", "introduction", "arxiv")):
            return clean
    return "UNKNOWN"

python

title = infer_title(text)
method = infer_method(title)
paper_slug = slugify(title)
method_slug = slugify(method, paper_slug)
implementation_slug = f"{method_slug}-reproduction"

yaml = f"""# Generated by build_paper_spec.py. Edit with paper evidence before scaffolding.
paper:
  title: "{title}"
  year: "UNKNOWN"
  venue: "UNKNOWN"
  task: "TODO"
  modality: "TODO"
  method_name: "{method}"
  paper_slug: "{paper_slug}"
  implementation_slug: "{implementation_slug}"

The parsed title is subsequently interpolated directly into generated Python source:

python

spec = parse_simple_yaml(spec_path)
title = spec.get("paper.title", "UNKNOWN")
method = spec.get("paper.method_name") or spec.get("paper.task") or "paper"
implementation_slug = spec.get("paper.implementation_slug") or f"{slugify(method, 'paper')}-reproduction"
out = Path(args.out) if args.out else (spec_path.parent / implementation_slug)

python

write(out / "config.py", f'''import argparse


def build_parser():
    parser = argparse.ArgumentParser(description="{title} reproduction scaffold")

Technical Analysis

Paper evidence is untrusted input. infer_title() accepts nearly any line of an appropriate length and does not escape quotation marks, back ...[truncated 1808 chars]

Remediation

View remediation

Remediation Suggestions

• Never interpolate untrusted metadata directly into generated Python source.

• Generate Python literals with repr(title):

  python

  title_literal = repr(title)
  source = f"parser = argparse.ArgumentParser(description={title_literal})"
  

• Prefer storing the title in a structured data file and loading it at runtime rather than generating it as source code.

• Replace the custom YAML-like parser and hand-built YAML output with a maintained YAML library using safe loading and serialization.

• Validate metadata types and reject control characters or unexpected multiline scalar values.

• Apply safe escaping independently for every output context, including Python, YAML, and Markdown.

• Add regression tests using titles containing double quotes, single quotes, backslashes, comment markers, newlines, triple quotes, and attempted Python statements.

• Run the static compilation check immediately after generation and treat any failure as a blocking error. Compilation checks detect malformed payloads but must not be treated as the primary injection defense.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold_repro_project.py:423

Finding

Unsafe Deserialization of User-Supplied PyTorch Checkpoints in Generated Projects

Content

View full analysis

Vulnerability Details

File Location: scripts/scaffold_repro_project.py:423-426
Vulnerability Type: Unsafe object deserialization
Risk Level: Medium

Vulnerable Code

The scaffold generator writes the following evaluation code:

python

if args.checkpoint:
    ckpt = torch.load(args.checkpoint, map_location=device)
    state = ckpt.get('model', ckpt)
    model.load_state_dict(state, strict=False)

Technical Analysis

PyTorch checkpoints have historically used Python pickle-based deserialization. Depending on the installed PyTorch version and its defaults, calling torch.load() without explicitly enabling restricted weights-only loading can deserialize attacker-controlled Python objects.

The generated requirements file does not pin a PyTorch version, so the security behavior depends on the environment in which the scaffold is installed. On versions or configurations where unrestricted pickle loading is used, a malicious checkpoint can invoke attacker-controlled reduction logic during deserialization.

The checkpoint path is directly controlled through the generated project's --checkpoint argument. map_location only controls tensor device placement and does not prevent malicious object reconstruction.

Attack Path

1. An attacker distributes a checkpoint claimed to reproduce or evaluate the paper.
2. The user downloads the checkpoint and supplies its path through --checkpoint.
3. The generated evaluation path calls torch.load() without explicitly requiring weights-only loading.
4. In an affected PyTorch environment, malicious pickle content is reconstructed.
5. The embedded payload executes before load_state_dict() validates or uses the model state.

Impact Assessment

If unrestricted deserialization is active, exploitation can result in arbitrary code execution with the privileges of the user running evaluation or inference. Accessible files, environment variables, cre ...[truncated 272 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly request restricted loading where supported:

  python

  ckpt = torch.load(
      args.checkpoint,
      map_location=device,
      weights_only=True,
  )
  

• Pin a PyTorch version that supports safe weights-only loading and document the minimum secure version.

• Accept state-dict-only checkpoints rather than arbitrary serialized Python objects.

• Validate that the loaded value is a dictionary with the expected key and tensor value types before passing it to load_state_dict().

• Prefer a non-executable tensor format such as SafeTensors when interoperability permits.

• Warn users never to load checkpoints from untrusted sources.

• If legacy unrestricted loading is required, make it an explicit opt-in operation with a prominent security warning rather than the default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个完整的“论文复现执行工作流”，覆盖论文解析、代码搜索、仓库获取、源码追踪、项目生成与报告产出等多步能力；而实际代码只是 inspect_repro_project.py，其用途是对一个已经生成好的复现工程做静态验收。它不接触论文来源，不联网，不克隆仓库，不分析论文内容，不生成项目，也不写 Markdown 报告。虽然“检查本地源码/复现工程”与声明中的部分环节有弱相关，但该代码的主要目的与声明的整体能力范围明显不一致，因此属于实质性描述与行为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to use shell, file read/write, environment inspection, cloning, and code-generation behaviors, but it does not declare an explicit tool/permission scope. In practice, that creates an authorization ambiguity: an orchestrator or reviewer cannot easily constrain what the skill may access, increasing the chance of unintended filesystem or command execution against sensitive workspace content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions explicitly require all answers to use Chinese, which is a natural-language policy constraint. The file does not indicate user opt-in or a justified region-specific limitation, so this is a locale/language policy violation under the rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The display name and description are entirely in Chinese, which indicates a fixed language presentation with no visible option for users to choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow explicitly authorizes automatic git clone of repositories once they are deemed 'official' or 'possibly official', but it does not require an explicit user confirmation or a clear warning that the agent will perform network access and modify the local workspace. In an agent setting, this can lead to unintended external connections, storage changes, and ingestion of untrusted code based on imperfect trust heuristics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 66% confidence

Finding

The natural-language instructions are entirely in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly requires generating a reproduction project and saving it under a workspace path, but it does not warn the user that new files and directories will be created locally. In an agent setting, undisclosed filesystem writes can violate user expectations, clutter or overwrite workspaces, and become more risky because the workflow may be triggered from untrusted paper inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly requires the report and chat response to be in Chinese, which overrides user preference and can reduce transparency if the user expects another language. In a security-sensitive or research workflow, forced language output can cause users to miss warnings, misunderstand execution boundaries, or fail to review generated actions accurately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire rubric is written as mandatory guidance in Chinese, with no indication that users may choose another language or that the file is intentionally limited to a Chinese-only audience. Under the policy, a skill that effectively enforces a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bootstrap_repo.py (reported line 54)May include surrounding context.

python

def run(cmd: list[str], cwd: Path | None = None) -> tuple[int, str]:
    try:
        proc = subprocess.run(cmd, cwd=str(cwd) if cwd else None, text=True,
                              stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=300)
        return proc.returncode, proc.stdout
    except FileNotFoundError as exc:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prints all user-facing status messages in Chinese, which imposes a specific language on users without any opt-in, configuration, or documented locale constraint. This matches the policy-violation category for language or locale restrictions in natural-language output.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_local_code.py (reported line 42)May include surrounding context.

python

if not (path / ".git").exists():
        return ""
    try:
        proc = subprocess.run(["git", "-C", str(path), "remote", "get-url", "origin"], text=True,
                              stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=10)
        return proc.stdout.strip() if proc.returncode == 0 else ""
    except Exception:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code includes multiple hard-coded Chinese user-facing strings in its output and result explanations, such as the reason labels and console messages. The file provides no language selection, opt-in, or documentation that the skill is intentionally limited to Chinese-speaking users, which creates a language-policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains multiple natural-language strings shown to the user in Chinese, including reason labels and console output. Because the script does not provide user opt-in or indicate that it is intentionally limited to a Chinese-speaking context, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python script emits all user-facing status and error messages in Chinese, including execution, validation, and conclusion output. That is a natural-language locale constraint affecting all users, and the file does not offer language selection or explain that the tool is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits error messages only in Chinese, and later status messages also continue in Chinese. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script prints its execution summary in Chinese only, with no indication that the skill is intended solely for Chinese-speaking users. This forces a locale choice in natural-language output and can violate organizational language policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill instructs the agent to inspect PAPER_REPRO_LOCAL_CODE_ROOTS and search local directories for source code, but it does not disclose this local-environment inspection to the user or bound the search scope tightly. That creates a privacy and safety risk because an agent may enumerate developer-defined filesystem locations or infer sensitive local project structure without explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow directs the generated project to save checkpoints and evaluation artifacts such as outputs/eval.json, but it does not clearly disclose that these artifacts will be persisted locally. While lower severity than broad project generation, silent artifact creation still creates data-handling and transparency issues in automated agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits a user-facing error message in Chinese regardless of the user's locale or preference. The file contains multiple Chinese status strings, and there is no opt-in, fallback, or documented locale constraint, which violates the language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/scaffold_repro_project.py:430