Security audit

对用户提供的任何学术论文

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to read academic papers, but it requests command, file, and URL-handling authority while also describing broader automation uses beyond paper analysis.

Review this skill before installing. It is not showing exfiltration, destructive actions, or hidden persistence, but you should only use it for academic papers you intentionally provide, avoid sensitive or internal URLs, and check where temporary and final report files are written.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest and description present the skill as a paper-reading tool, but the same text broadens scope to generic data analysis, reporting, visualization, and other automation tasks. This capability drift can cause the agent to invoke a more privileged skill in contexts the user did not intend, increasing the chance of unnecessary file, network, or execution access.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented scenarios include generic PDF processing, report generation, and content generation, which materially exceed the paper-analysis purpose. In an agent setting, overbroad capability descriptions can lead to inappropriate routing and tool use, including executing actions on arbitrary user content under a misleadingly narrow skill name.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs use of shell commands such as pdftotext and downloading PDFs from URLs for processing. For a paper reader, enabling command execution and network retrieval expands the attack surface to SSRF-like access, processing of hostile files, and command misuse if paths or arguments are derived from untrusted input.

Intent-Code Divergence

Low

Confidence: 85% confidence
Finding: The feature overview mixes a paper-focused purpose with broad claims such as API integration, command execution, and generic information retrieval. While partly documentation drift, this can normalize high-risk tool use for routine paper analysis and encourage invocation in broader contexts than intended.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation description is broad, ambiguous, and even mixes unrelated triggers such as data analysis, report generation, and visualization. In agent systems, vague triggers are dangerous because they can cause over-invocation of a skill with read/exec/write privileges in situations where a narrower, safer capability would suffice.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The feature overview repeats an open-ended trigger without meaningful exclusions, reinforcing overbroad routing behavior. Because the skill has file and command capabilities, excessive invocation scope increases the chance of unnecessary exposure to untrusted inputs and privileged actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions tell the agent to download and process user-provided paper URLs without a clear user-facing warning or consent step for network access. This can lead to silent outbound requests to attacker-controlled or internal endpoints, creating privacy, SSRF, and policy-compliance risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow creates temporary and final files but does not clearly disclose local file writes to the user. Undisclosed persistence can leak sensitive paper contents, leave artifacts on shared systems, and violate least-surprise expectations for a reading skill.

Static analysis

No suspicious patterns detected.