Security audit

论文写作助手免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is a thesis-writing helper, but it requests command execution and broad file access while also using overly broad activation text and an under-explained callback URL.

Review this carefully before installing. It is not malicious on the artifact evidence, but you should only use it for thesis-related work, avoid giving it broad workspace access, do not provide callback URLs unless you trust the endpoint, and require confirmation before any shell command, npm install, or document scan runs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest presents the skill as a narrow local thesis-writing helper, but the declared tools and documented workflows extend into general command execution and file-processing behavior. This mismatch increases the chance that the agent will invoke the skill in broader contexts than users expect, enabling unnecessary access to local files and execution surfaces.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Granting exec to a thesis-writing assistant is excessive because its core functions do not inherently require arbitrary shell execution. If the agent follows skill guidance or user-provided parameters through exec, this could expose the host to command injection, unauthorized local actions, or abuse of the agent runtime.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The skill claims the free version is limited to core writing features, but later sections describe broader analysis, extraction, configuration, and workflow operations. This inconsistency can mislead users and routing systems about what the skill may actually do, increasing the risk of over-privileged invocation and unintended data handling.

Vague Triggers

High

Confidence: 91% confidence
Finding: The activation text is overly broad, extending from thesis help to generic marketing copy, title optimization, and content creation. Broad routing criteria can cause the agent to select this skill for unrelated requests, unnecessarily exposing read/exec/glob/grep capabilities in contexts that do not need them.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The keyword coverage includes vague triggers like generic content-creation phrases and filler terms such as 'Use' and 'when', which weakens scope boundaries. In an agent ecosystem, ambiguous triggers increase accidental activation of a skill that has filesystem and command-execution access.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The documented callback_url parameter implies that results may be sent to an external endpoint, but the skill does not warn about data egress, trust boundaries, or validation requirements. In a thesis-writing context, this could leak drafts, citations, or other potentially sensitive academic content to attacker-controlled destinations.

Static analysis

No suspicious patterns detected.