科研学术助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This academic helper is broadly coherent and uses local, user-directed document/literature workflows, with no evidence of hidden execution, credential access, exfiltration, or system persistence.

Install only if you are comfortable using a Chinese-focused academic helper. Avoid uploading confidential drafts, reviewer comments, grant ideas, patent-sensitive material, or private datasets unless your agent environment handles them appropriately; enable online literature search only when you accept that queries may reveal research interests to external services. Expect helper scripts, if run, to create local report or JSON files next to the input files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个较全面的学术辅助技能，重点在文本生成/改写与文件解析、联网检索。实际代码仅处理CSV格式的文献条目数据，进行汇总、搜索、筛选、Markdown表格生成和JSON导出，属于文献矩阵整理工具。虽然“文献综述生成”与代码中的摘要生成功能有部分相关性，但这里的摘要只是基于已有结构化字段做统计汇总，不是通常意义上的综述生成。整体上，主要目的和核心能力与声明存在显著不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 代码的主要功能仅与“论文润色”部分部分吻合，而且实现也较为有限：主要通过正则进行英文写作风格、长句、绝对化词汇和引用格式的简单检查，并输出报告。与声明相比，缺失了两个核心功能（文献综述生成、创新点提炼），也没有看到双语处理能力、PDF/DOC文件解析能力或任何联网检索逻辑。代码访问的资源也与声明不一致：它只读取本地文件路径并按纯文本处理。因此该描述明显高估并扩展了代码实际能力，属于实质性不匹配。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all guidance solely in Chinese and does not indicate that users may choose another language or that the content is intentionally limited to a Chinese-only audience.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This code's user-facing natural language is entirely in Chinese, including the module description and later CLI messages, with no indication that users can choose another language. The policy for natural-language violations applies to all file types and flags language constraints that are imposed without user opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes an academic helper centered on manuscript polishing, review generation, innovation extraction, and direct PDF/DOC processing. This file instead implements a local literature-matrix utility that loads CSV records, generates tabular summaries, and writes CSV/JSON outputs; there is no PDF/DOC parsing and no text-polishing or innovation-extraction logic.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code defines the skill description and all CLI messages in Chinese only, including the module docstring and runtime prompts. That imposes a specific language on users without presenting an option to select locale, which matches the language/locale policy violation criteria.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill encourages users to upload academic documents and states that text will be automatically extracted, but it provides no warning that uploaded files may contain sensitive unpublished research, personal data, reviewer comments, or proprietary material. This can lead users to disclose confidential content without informed consent about how the data will be processed.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill advertises online literature search when networking is enabled, but it does not warn users that their search terms may be transmitted to external services. In an academic context, queries can reveal unpublished topics, grant directions, patent-sensitive ideas, or institutional research interests.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This markdown file contains natural-language guidance framed specifically around '中英文学术写作差异' and directs writing toward English academic norms. Because the policy category applies to all file types and forbids forcing a specific language without user opt-in, this is a mild locale/language constraint that is not explicitly presented as optional.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: After analyzing the CSV, the script automatically saves a JSON file alongside the input. The manifest focuses on research-assistance capabilities and does not indicate that running analysis will persist transformed outputs to disk, making behavior broader than the described user-facing function.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: 技能描述强调论文润色、文献综述和创新点提炼，并提到可上传文件直接处理，但这里的实现除了分析输入文件外，还会在本地生成并保存新的 `.polish_report.txt` 文件。对用户而言，这是额外的持久化副作用，未在描述中体现。

Static analysis

No suspicious patterns detected.