论文解析工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.2

Overview

The skill appears to be a PDF paper parser, but it asks for broader execution, writing, callback, and generic modify/delete capabilities than it clearly scopes or explains.

Review this skill before installing. Use it only in a constrained environment, avoid granting unrestricted shell/write access unless needed, do not provide sensitive PDFs unless you trust the publisher, avoid callback_url unless you intend to send results externally, and prefer pinned dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:141

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:141, SKILL.md:227-228
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:141:

bash

pip install requests

SKILL.md:227-228:

bash

pip install pypdf
pip install pdfplumber

Technical Analysis

The Skill instructs users or an executing Agent to install requests, pypdf, and pdfplumber without fixed versions or package integrity hashes. Consequently, installation resolves whichever compatible releases the configured package index provides at execution time.

This prevents the reviewed Skill from defining a reproducible and verifiable dependency set. If a dependency release or configured package source is compromised, malicious installation hooks or package code could execute with the privileges of the user running pip. Dependency code may also execute later when imported by the PDF parser.

The demonstrated parser imports pypdf, but it does not use requests. Installing an unused package unnecessarily increases the dependency and supply-chain attack surface.

No evidence indicates that these packages are currently malicious or that the Skill intentionally retrieves a malicious payload. The risk arises from unpinned, unhashed dependency installation and is contingent on compromise or manipulation of the package supply chain.

Attack Path

1. An attacker compromises a dependency release, its publisher account, or a package index used by the environment.
2. A user or Agent follows the Skill instructions and runs an unpinned pip install command.
3. pip retrieves the attacker-controlled package version because no reviewed version or integrity hash is enforced.
4. Malicious package installation logic executes, or malicious runtime code executes when the package is imported.
5. The payload operates with the permissions of the user or Agent process.

Impact Assessm

...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requests installation instruction unless the implementation genuinely requires that package.
2. Pin every direct dependency to a reviewed version, for example:

   text

   pypdf==REVIEWED_VERSION
   pdfplumber==REVIEWED_VERSION
   

3. Place dependencies in a lock file or requirements file and require cryptographic hashes, such as with pip install --require-hashes -r requirements.txt.
4. Pin and review transitive dependencies as part of the lock process.
5. Install packages only from an explicitly trusted package index, and prevent fallback to untrusted or unintended indexes.
6. Perform dependency vulnerability and provenance checks before publishing updates.
7. Install dependencies in an isolated virtual environment with minimal filesystem, credential, and network access.
8. Avoid running package installation or PDF processing with administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Declaring exec for a document parsing skill unnecessarily grants shell execution to a workflow that should usually be satisfied by local library calls. If the agent follows the skill literally, crafted inputs or future prompt additions could pivot the skill into arbitrary command execution, exposing the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises exec, write, and callback_url-related behavior without clearly disclosing file-system, process, or network side effects. In an agent environment, that lack of transparency can lead users or orchestrators to invoke the skill as if it were read-only parsing, while it may write files, execute commands, or contact external endpoints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a narrow PDF/paper parsing tool, but the documented capability model expands into generic create/query/modify/delete operations via runtime parameters. That scope mismatch can cause an agent or user to authorize actions far beyond document extraction, increasing the chance of unintended file or system side effects under a misleading description.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation examples and keyword coverage are broad and underspecified, which makes the skill easier to trigger in contexts unrelated to safe paper parsing. Loose activation criteria increase the risk that an agent applies this skill to ambiguous prompts and then uses its declared tools in ways the user did not clearly request.

Content

No source excerpt is available for this finding.