arXiv Daily Paper Pusher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its default network and logging behavior can expose or misuse the Feishu webhook and can forward untrusted cleartext arXiv fallback results into a chat.

Install only if you are comfortable sending selected paper titles, links, group names, and keyword-derived interests to the configured Feishu/Lark chat. Store the webhook URL as a secret, restrict config and log permissions, avoid cron log exposure, prefer arxiv_only or an HTTPS fallback, and pin dependencies before unattended scheduled use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: push_feishu.py:34

Finding

Webhook Secret May Be Exposed Through Exception Logging

Content

View full analysis

> cron.log 2>&1 ``` Under that setup, exception output is persistently written to `cron.log`. The token can consequently remain available to any user or process permitted to read that file. ### Attack Path 1. The operator configures a valid Feishu webhook URL containing its secret token. 2. An HTTP failure occurs while posting to the webhook, such as a connection error, redirect failure, proxy error, or rejected response. 3. The resulting exception contains the request URL. 4. The generic exception handler prints the unsanitized exception. 5. If the documented cron configuration is used, the output is appended to `cron.log`. 6. A local us ...[truncated 582 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_papers.py:147

Finding

arXiv API Fallback Uses Unencrypted HTTP

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependencies Are Not Reproducibly Pinned

Content

View full analysis

=2.1.0 PyYAML>=6.0 requests>=2.31.0 ``` ### Technical Analysis All dependencies use open-ended lower bounds. A future installation can therefore select any later version accepted by the package resolver. No lock file or package hashes are provided to verify that installed artifacts match versions reviewed during the audit. There is no evidence that the named packages are malicious or typosquatted. The issue is that the effective dependency code can change after review through a future upstream release, package-index compromise, or altered transitive dependency resolution. Because the application imports these packages at startup and is intended to run as a scheduled task, compromised dependency code would execute with the same account permissions as the scheduled process. ### Attack Path 1. A future release of a direct or transitive dependency is compromised, malicious, or unexpectedly incompatible. 2. An operator performs a fresh installation or upgrade using `pip install -r requirements.txt`. 3. The resolver selects the affected newer release because the requirements contain no upper or exact version constraints. 4. The package is installed without hash verification. 5. The scheduled application imports the package. 6. Any malicious package initialization or invoked dependency logic executes with the privileges and data access of the account running the Skill. ### Impact Assessment Potential impact depends on the contents of a compromised dependency and the privileges of the scheduled account. At maximum, malicious dependency code could read files accessible to that account, obtain the webhook configuration, make network requests, alter application output, or execute local commands. The project itself does not request elevated privil ...[truncated 105 chars]

Remediation

View remediation

--hash=sha256: PyYAML== --hash=sha256: requests== --hash=sha256: ``` The actual versions and hashes should be generated from tested artifacts rather than copied from an unverified source. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly sends ranked paper results to an external Feishu webhook, but the description does not clearly warn users that selected content and related configuration-driven output will be transmitted off-platform. This creates a transparency and data-handling risk: users may enable or configure the skill without realizing that fetched content and possibly sensitive research-interest metadata inferred from keywords will be sent to a third-party endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code defines a fixed UTC+8 local timezone and uses the same default timezone offset elsewhere, which imposes a locale-specific interpretation of dates and times. There is no natural-language justification or indication that users can choose or opt into this locale behavior by default.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · push_feishu.py (reported line 37)May include surrounding context.

python

payload = {"msg_type": "text", "content": {"text": message_text}}

    try:
        resp = requests.post(webhook_url, json=payload, timeout=10)
        resp.raise_for_status()
        return True
    except Exception as e:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · push_feishu.py (reported line 105)May include surrounding context.

python

payload = {"msg_type": "text", "content": {"text": message_text}}

    try:
        resp = requests.post(webhook_url, json=payload, timeout=10)
        resp.raise_for_status()
        return True
    except Exception as e:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The skill documentation is predominantly in Chinese and does not indicate that other languages are supported or that the language is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue when no locale choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents configuring a Feishu webhook and pushing matched paper information to a group chat, which is a network action that transmits data outside the local system. The README explains how to enable the push but does not include any user-facing warning about external transmission, destination visibility, or verifying that the webhook targets the intended group.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This manifest/config file contains user-facing comments such as setup instructions and setting descriptions exclusively in Chinese. That creates a language policy concern because it forces a specific language for understanding and configuring the skill without offering any alternative or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The fallback HTTP API uses plain http://export.arxiv.org/api/query, so search queries and responses are sent without transport encryption. This enables passive observation and active tampering by network attackers, which is especially relevant because the XML response is parsed and used to produce output; although the data is not highly sensitive by default, integrity and privacy are still at risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency specification for arxiv uses a lower-bound only version constraint, which makes builds non-reproducible and allows future package releases to be installed without review. While this is not an exploit by itself, it increases supply-chain risk because a later vulnerable or malicious release could be pulled into the environment unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

arxiv>=2.1.0
PyYAML>=6.0
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

PyYAML is specified with only a minimum version, so the actual installed version can vary over time and may include vulnerable releases or breaking changes. This is more concerning here because PyYAML has a history of security advisories, making unpinned installation a meaningful supply-chain and exposure risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

arxiv>=2.1.0
PyYAML>=6.0
requests>=2.31.0

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest does not pin PyYAML, and PyYAML has multiple known advisories, so it is impossible to verify from this file whether the installed version is affected. In a skill context, this uncertainty matters because YAML libraries are often used on externally supplied content, which can turn a versioning weakness into a real security issue if unsafe parsing is present elsewhere.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Requests is also unpinned, so deployments may resolve to different versions over time, including versions later found vulnerable. Because requests is commonly used for network communication and has multiple historical advisories, leaving it unpinned raises the risk of pulling in an affected release.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

arxiv>=2.1.0
PyYAML>=6.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The unpinned requests dependency prevents verification that a non-vulnerable release will be installed, despite multiple known advisories affecting historical versions. Since requests is typically used for outbound HTTP interactions, an affected version could expose credentials, TLS behavior, or request handling in ways that increase attack surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.