Emergence Agentic Academic Writing Skill Implementing the Paper Ochestra Paradigm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 0.1.0

Overview

This skill is not clearly malicious, but it needs review because it combines automatic research-note persistence, local filesystem mutation, and an under-explained external API connection.

Install only if you are comfortable with a writing skill that saves interview content into local project files and references an external Emergence API that is not clearly documented. Review or fix the scaffold script before running it, use a simple project directory name inside a dedicated workspace, and avoid entering confidential research material unless you accept that it may be persisted in idea.md.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold.sh:31

Finding

Unescaped Project Name Allows Generated JSON Injection and Corruption

Content

View full analysis

"$PROJECT_NAME/metadata.json" <

Remediation

View remediation

"$PROJECT_DIR/metadata.json" ``` 2. Quote all shell expansions, including: ```bash printf '%s' "$PROJECT_NAME" ``` 3. Separate the display name from the filesystem directory name. Restrict the directory name to an allowlist such as letters, digits, underscores, and hyphens. 4. Resolve the destination to a canonical path and verify that it remains under an explicitly approved workspace. 5. Refuse to overwrite an existing project unless the caller supplies an explicit, documented overwrite option. 6. Validate the generated file with `jq empty metadata.json` before reporting successful initialization. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/scaffold.sh:68

Finding

Scaffolding Script Ignores Definite Failures and Reports False Success

Content

View full analysis

Remediation

View remediation

&2' ERR ``` 5. Verify all required directories and files before printing the success message: ```bash test -d "$PROJECT_NAME/sections" test -f "$PROJECT_NAME/idea.md" test -f "$PROJECT_NAME/metadata.json" test -f "$PROJECT_NAME/README.md" ``` 6. Return a nonzero exit status for every partial or failed initialization so callers can reliably detect failure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is a multi-agent scholarly writing framework, but the described behavior includes local scaffolding and persistent file writes without corresponding permission declarations or clear runtime controls. This mismatch is dangerous because users may trust the skill as a conceptual writing assistant while it performs environment-modifying actions, which undermines informed consent and can hide operational risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill describes use of a shell-based scaffolding mechanism (scaffold.sh) and file-writing behavior, but it does not declare any tool scope or permissions. That creates an authorization and transparency gap: users and hosting systems cannot accurately assess what capabilities the skill expects, increasing the risk of unintended filesystem actions if the skill is enabled in an environment with shell access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that every user response is automatically persisted to idea.md, but it provides no warning, consent flow, or data-minimization guidance. In a research-writing context, users may share unpublished ideas, proprietary data, personal information, or confidential drafts, so silent persistence materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · manifest.json (reported line 12)May include surrounding context.

json

},
  "api": {
    "type": "openapi",
    "url": "https://api.emergence.science/openapi.json"
  },
  "discovery": {
    "content_index": "https://api.emergence.science/content/index.json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · manifest.json (reported line 15)May include surrounding context.

json

},
  "api": {
    "type": "openapi",
    "url": "https://api.emergence.science/openapi.json"
  },
  "discovery": {
    "content_index": "https://api.emergence.science/content/index.json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill_manifest.json (reported line 19)May include surrounding context.

json

},
  "api": {
    "type": "openapi",
    "url": "https://api.emergence.science/openapi.json"
  },
  "discovery": {
    "content_index": "https://api.emergence.science/content/index.json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill_manifest.json (reported line 22)May include surrounding context.

json

},
  "api": {
    "type": "openapi",
    "url": "https://api.emergence.science/openapi.json"
  },
  "discovery": {
    "content_index": "https://api.emergence.science/content/index.json"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README directly instructs users to execute a local shell script but provides no description of what the script changes, what privileges it requires, or how to inspect it safely beforehand. In an agent-skill ecosystem, users may treat setup commands as trusted boilerplate, which increases the chance of unreviewed execution of potentially destructive or privacy-impacting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This shell script creates directories and writes several files into a user-supplied project path, but the only user-facing output is a success message after the changes are complete. There is no prior warning, confirmation prompt, or explanatory notice that running the script will modify the filesystem in the specified location.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

At L70, the comment says the script "should be in the skill scripts folder," but the code actually runs chmod +x on $PROJECT_NAME/scaffold.sh, a file path inside the newly created project. This is an active contradiction between the inline documentation and the operation performed.

Content

No source excerpt is available for this finding.