Security audit

对用户提供的任何学术论文

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly for reading academic papers, but its instructions and declared capabilities are broader than needed and include command execution, downloads, and local file creation.

Review before installing. This skill appears intended for academic paper analysis, not harmful behavior, but it should be tightened so it only activates for paper/PDF/DOI/arXiv-style tasks, only downloads documents the user explicitly provides, and limits command execution and file writes to the paper-processing workflow.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest frames the skill as academic paper parsing, but the description expands it into generic data analysis, reporting, visualization, and multi-source processing. This scope inflation can cause over-triggering and lead agents to grant or use broader capabilities than users would reasonably expect from a paper-reading skill.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill exposes exec and explicitly instructs use of pdftotext even though its primary function is document analysis. Command execution materially increases attack surface because untrusted user-supplied PDFs, URLs, filenames, or derived arguments may be routed into shell commands, enabling command injection or unsafe file/system access if the runtime or wrapper is weak.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Advertising external API integration and generic information retrieval extends the skill beyond paper parsing and creates ambiguity about what remote systems may be contacted and what data may be sent. In a skill that handles user documents, that can enable unnecessary data egress, privacy issues, and overbroad invocation behavior.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation text is broad enough to match common requests such as analysis, summaries, reports, statistics, and visualization, many of which are not specific to academic papers. Overbroad routing is dangerous because it can cause this skill to activate in unrelated contexts and exercise read/write/exec capabilities on inputs that were never meant for a paper parser.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions say the skill may download PDFs from URLs and create intermediate and final local files, but this side effect is not clearly disclosed up front to users. Hidden network fetches and file creation are risky in document-processing skills because they can surprise users, persist sensitive content locally, and process attacker-controlled remote resources without informed consent.

Static analysis

No suspicious patterns detected.