Security audit

论文解析工具（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a paper PDF parsing skill, but it asks for broad exec/write authority and includes under-scoped modify/delete and callback behavior.

Install only if you are comfortable with the agent running local Python commands and writing files for PDF parsing. Use explicit file paths, review commands before execution, avoid sensitive PDFs unless needed, and do not provide a callback_url unless you trust the destination and intend to send results there.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a narrowly scoped paper/PDF parsing tool, but the capability section expands its authority to generic create/query/modify/delete operations. That mismatch weakens least-privilege expectations and can cause an agent or user to permit broader actions than are justified by the advertised purpose, especially given the declared exec/write tools.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: A local PDF parsing skill should not implicitly introduce asynchronous network callback behavior without a clear need and explicit safety boundaries. Adding callback semantics broadens the trust boundary and can enable unintended data egress or interaction with attacker-controlled endpoints.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The documented callback_url parameter creates a remote communication channel unrelated to the core paper-parsing purpose. Even if not implemented, documenting it invites agents to exfiltrate extracted document content or metadata to external systems without clear authorization controls.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The documentation contains conflicting trust signals: it says no extra API key is needed while also declaring an LLM API dependency as required. This inconsistency can mislead users about external service usage, data flow, and credential requirements, increasing the chance of unsafe deployment or unintended disclosure to third-party services.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation examples are broad and underspecified, which increases the chance that an agent will trigger the skill for loosely related prompts without clear scope checks. In a skill with exec/write capabilities, ambiguous activation language can lead to unnecessary file access, command execution, or unintended processing of sensitive documents.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description markets harmless document parsing but omits any warning that the skill has exec and write capabilities. That concealment is dangerous because users and orchestrators may trust it as read-only while it can potentially modify files or run commands, making the context more risky than the benign description suggests.

Static analysis

No suspicious patterns detected.