并行研究助手免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed research-documentation helper that stores topic notes locally and uses search, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install only if you are comfortable with the agent saving research topics and derived notes under ~/.research-workspace and sending search terms to the agent's search provider. Avoid using it for secrets or sensitive internal research unless you control the storage location and search behavior; install optional PDF dependencies in an isolated environment when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:454

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 454
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Code Snippet:

markdown

| PyMuPDF | Python package | Optional | `pip install pymupdf` (PDF export) |

Technical Analysis

The documented installation command retrieves the latest available version of PyMuPDF without pinning a reviewed version or verifying package integrity. This makes installation behavior non-reproducible and exposes users to upstream supply-chain risks.

Python package installation may execute package-controlled build or installation logic. If the package distribution or configured package index is compromised, a malicious release could execute arbitrary code during installation. The project contains no evidence that PyMuPDF itself is malicious; the risk arises from accepting an unpinned package from the active package index without hash verification.

Attack Path

1. A user requests the optional PDF export capability.
2. The agent or user follows the dependency instruction in SKILL.md.
3. The command pip install pymupdf resolves the latest package version from the configured Python package index.
4. If that distribution or index has been compromised, malicious build or installation logic executes locally.
5. The payload runs with the privileges of the account invoking pip.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privileges. The accessible scope could include the user's files, environment variables, credentials readable by that account, research documents, and network resources available to the process. If the command were run from an elevated shell, the impact could extend to system-wide resources, although the Skill does not explicitly instruct users to elevate this Python package installation.

Remediation

View remediation

Remediation Suggestions

• Pin PyMuPDF to a specifically reviewed version rather than installing the latest release.

• Record and verify package hashes using a locked requirements file and pip install --require-hashes.

• Use an explicitly trusted Python package index and disable unneeded supplemental indexes to reduce dependency-confusion exposure.

• Install the dependency in an isolated virtual environment with a non-privileged user account.

• Regularly review and update the pinned version through a controlled dependency-update process.

• Document a hardened installation example, such as:

  bash

  python -m venv .venv
  . .venv/bin/activate
  python -m pip install --require-hashes -r requirements.txt
  

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to create per-topic folders and persist prompts, research notes, and exported PDFs under ~/.research-workspace, but it does not clearly warn users that their inputs and derived content will be written to local storage. This can expose sensitive research topics, copied source material, or confidential notes to other local users, backups, or later unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes iterative internet-based searching as a core behavior but does not disclose that user prompts, research topics, or document excerpts may be sent to external search providers or remote services. If users research confidential business, academic, or personal matters, this can cause unintended data disclosure outside the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The configuration example establishes a persistent workspace and writes a config file under ~/.research-workspace, creating durable session state across runs without a clear consent or retention notice. Persistent research artifacts can accumulate sensitive topics, notes, and metadata that remain available long after the immediate task completes.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

bash

# 创建研究工作区
mkdir -p ~/.research-workspace/research
# ...
# 配置研究偏好
cat > ~/.research-workspace/config.yaml << 'EOF'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

PDF 导出需要安装 pandoc 和 PyMuPDF。可通过系统包管理器安装.

bash

# 依赖说明
# Ubuntu: sudo apt install pandoc
# macOS: brew install pandoc
# Windows: choco install pandoc

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill includes commands to create the research workspace as part of environment verification, again reinforcing persistent local state without an explicit user-facing warning. Even seemingly harmless directory creation can normalize silent storage of future sensitive research content and broaden the skill’s filesystem footprint.

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

免费版基于 Markdown 指令驱动，无需额外 API Key.

bash

# 验证工作区可写
mkdir -p ~/.research-workspace/research && echo "ok"
# ...
# 验证PDF导出工具（可选）
pandoc --version 2>/dev/null && echo "pandoc就绪" || echo "pandoc未安装（PDF导出不可用）"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown example sets language: "zh-CN", which imposes a specific language/locale in natural-language content. The file does not present this as optional or offer a user-selectable language preference, so it conflicts with the requirement to avoid forcing a locale without opt-in.

Content

No source excerpt is available for this finding.