Security audit

Paper Deep Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed research-paper reading workflow with local note-generation helpers and no evidence of hidden access or unsafe behavior.

Reasonable to install from a security perspective. Use it on papers and note paths you intend the agent to read or write, and review script-generated tables because the artifacts themselves describe them as heuristic drafts. The publisher should fix the missing shared script module and inconsistent reference paths for reliable operation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly related to paper analysis, but its primary function is much narrower and more mechanical than the declared description. It does not generate comprehensive reading notes, technical summaries, critiques, or implementation memos; instead it extracts likely claim sentences and links them to evidence references using regexes and cue words. It also lacks the deep analytical behaviors emphasized in the description, such as reconstructing derivations, theorems, empirical design, assumptions, limitations, or broader literature context. Because the actual implemented behavior is a specialized claim-matrix builder rather than a general deep-reading skill, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad, comprehensive single-paper deep-reading skill able to reconstruct and analyze many aspects of a paper across technical disciplines. The supplied code does not implement that general capability. Instead, it performs one specific subtask: generating a limitations ledger from markdown/text by cue-based extraction and heuristic inference. While limitations are mentioned in the description as one possible aspect of analysis, the actual code is materially narrower and does not support the broader promised outputs such as equation reconstruction, theorem analysis, algorithm reconstruction, experiment synthesis, or literature-context notes. Therefore the description overstates the implemented behavior and the primary purpose is mismatched.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a comprehensive paper-analysis skill intended to deeply read one selected research paper and generate substantial analytical outputs such as reading notes, summaries, critiques, or implementation memos. The supplied code does not do that. It only extracts mathematical symbols and simple prose-defined meanings from a text/markdown document and formats them as a notation table, optionally saving JSON. While notation extraction is related to one subtask mentioned in the description, the code’s primary purpose is materially narrower and different from the declared skill. There is no implementation of deep reading, summarization, critique, theorem/derivation reconstruction, experiment analysis, figure/table extraction, or literature-context synthesis. Therefore the description overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a high-depth paper analysis tool for a single research paper, suitable for reconstructing technical details and generating rigorous notes or critiques. The supplied code does something much narrower: it reads a markdown/text file, extracts abstract/introduction/conclusion-related text, uses cue-word heuristics to guess paper type and domain, finds a first claim sentence, identifies a few technical object keywords, and emits a compact bullet-point 'paper map' plus optional JSON. This is related to paper summarization, so it is not wholly unrelated, but the primary purpose is materially shallower and different from the declared deep-reading capability. There is no evidence of equation reconstruction, theorem/derivation analysis, experimental or appendix synthesis, critique generation, or implementation memo creation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a substantive research-paper reading and analysis skill. The supplied code, however, is only a formatter/assembler for a markdown note template. It parses arguments, loads metadata and section content from files, replaces named sections in a template, and writes the rendered note. There is no code for ingesting a paper, extracting or interpreting technical content, summarizing arguments, critiquing methods, reconstructing equations, or performing any deep-reading behavior. While this script could be a supporting component within a larger paper-analysis workflow, the code chunk itself materially differs in primary purpose from the declared skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a substantive paper-reading and synthesis capability across technical disciplines. The supplied code does not inspect a paper, parse equations, reconstruct derivations, summarize experiments, or critique content. Instead, it accepts metadata arguments like title, authors, year, venue, source, DOI, and URL; loads a base markdown template; replaces a few placeholders; emits frontmatter; and writes an output markdown file. This is a materially different primary purpose: note scaffold creation, not deep reading or technical analysis. No suspicious extra capabilities are present, but the core behavior is far narrower and different than declared.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.