T06 · System Persistence
Warning
- Location
SKILL.md:108- Finding
Persistent Hourly Execution Through Documented Scheduled Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Survey Self Improve
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent survey-generation purpose, but it should be reviewed because it automatically compiles untrusted text into PDFs and encourages recurring automated runs without adequate safeguards.
Install only if you are comfortable running it in a restricted working directory with no sensitive files nearby. Avoid enabling the hourly schedule, review generated citations and claims manually, and treat PDF compilation from arXiv/user input as unsafe unless the code is fixed to use HTTPS, strict filename containment, LaTeX escaping, and sandboxed pdflatex execution.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
generator.py:21- Finding
User-Controlled Path Traversal and LaTeX Injection in Basic Survey Generation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
arxiv_generator.py:76- Finding
Plaintext arXiv Metadata Is Inserted into LaTeX and Automatically Compiled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Selecting topics from presets and producing boilerplate content while claiming high-quality novelty-aware survey generation creates a false sense of rigor. In context, this is especially risky because the skill targets academic writing, where unverifiable quality claims can mislead users into trusting weak or fabricated synthesis.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises high-quality, novelty-aware, quality-controlled survey generation, but much of the output is assembled from static templates, weak keyword counting, and superficial rewriting. This creates a high risk of deceptive or unreliable output presented as authoritative research analysis, undermining user trust and potentially propagating false academic claims.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill inserts claims about experimental setup, baseline comparisons, and ablation studies that are generic boilerplate rather than evidence-based analysis of the retrieved papers. This can mislead users into trusting fabricated scholarly content, which is a security-relevant integrity issue in a tool marketed as an automated academic survey generator.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a high-quality academic survey generator with live arXiv search and substantive analysis features. In this file, generation is entirely based on hardcoded topic keyword mapping, canned section text, fixed tables, and static references, with no network access, search, novelty detection, or optimization loop implementation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises and documents capabilities that imply shell execution, file reads/writes, network access, and PDF compilation, but it declares no corresponding tool scope or permissions. This is dangerous because users and orchestration systems cannot accurately assess or constrain what the skill needs, increasing the risk of unintended file modification, subprocess execution, or network use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation encourages fully automated, periodic execution, PDF compilation, and report sending without warning that files will be created or modified and that automated system actions may occur. In scheduled contexts, this lack of notice increases the chance of unattended filesystem changes, subprocess execution, and uncontrolled output growth.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a high-quality survey generator with capabilities such as novelty detection, quality control cycles, and automatic optimization. In this file, the implemented behavior is limited to fetching arXiv metadata, doing lightweight heuristic analysis, templating a survey, and invoking pdflatex; there is no code for novelty checking, iterative quality control, or optimization loops.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Generating a survey text from arXiv results is consistent with the skill's purpose, but spawning a local compiler introduces an additional execution capability beyond text generation itself. The manifest mentions survey generation quality and optimization features, but does not declare or justify local subprocess execution as part of the skill's scope.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
The code compiles generated LaTeX by invoking pdflatex on content derived from untrusted arXiv metadata such as titles, abstracts, and author names, but it does not escape LaTeX-special characters or disable dangerous TeX features. This creates a realistic injection surface where crafted paper metadata could break compilation or, depending on TeX configuration, trigger file reads or command execution via TeX primitives during compilation.
- Content
python def _compile_pdf(self, tex_file): try: for _ in range(2): subprocess.run( ['pdflatex', '-interaction=nonstopmode', str(tex_file)], cwd=str(tex_file.parent), capture_output=True,
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code advertises an LLM-based evaluator, but the implementation is entirely heuristic and keyword-count based. This is a security-relevant integrity issue because downstream agents or users may trust the output as model-based qualitative assessment when it can be trivially gamed by stuffing sections, transitions, citations, or LaTeX markers to inflate scores.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Invoking a local LaTeX compiler is beyond simple text generation and materially increases the attack surface of the skill. In this context, the compiler processes documents built from network-fetched content, so the added host-side execution path is not just incidental functionality but a potentially dangerous trust boundary crossing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The subprocess-based PDF compilation occurs automatically without explicit warning or confirmation, so users may unknowingly trigger local execution of a complex compiler on externally sourced content. While this overlaps with the broader LaTeX-execution risk, the lack of consent increases the chance of unsafe use in environments where such execution would not otherwise be permitted.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
The code launches a local pdflatex subprocess on generated content, which gives the skill host command-execution capability and exposes the environment to risks associated with TeX compilation. Because the .tex content incorporates remote arXiv metadata such as titles, summaries, and author names without robust escaping, a malicious paper entry could inject LaTeX primitives that read local files or abuse compiler features depending on the TeX configuration.
- Content
python def _compile_pdf(self, tex_file): try: for _ in range(2): subprocess.run( ['pdflatex', '-interaction=nonstopmode', str(tex_file)], cwd=str(tex_file.parent), capture_output=True,
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring and method docstrings state broad, bespoke generation behavior, yet the code mainly fills a static LaTeX template using canned prose and a small keyword map. This is an active contradiction about the degree of customization and capability, not merely omitted detail.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The surrounding skill intent is an academic survey generator, where 'generate references' implies assembling supporting citations for the requested topic. Instead, this function returns a tiny static list plus a few topic-conditioned entries, with no evidence of retrieval, verification, or comprehensive reference generation.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The code writes attacker-controlled topic text directly into a LaTeX document and then invokes pdflatex on it. Even though subprocess.run is used without shell=True, the real risk is LaTeX injection: crafted topic content can introduce TeX commands that read local files, consume resources, or trigger risky TeX features during compilation, and this skill automatically compiles that untrusted document.
- Content
python def _compile_pdf(self, tex_file): try: for _ in range(2): subprocess.run( ['pdflatex', '-interaction=nonstopmode', str(tex_file)], cwd=str(tex_file.parent), capture_output=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill repeatedly overwrites the provided .tex file in place, with multiple methods modifying content and writing it back without backup, confirmation, or atomic safety checks. This can destroy user data, corrupt documents after partial failures, and make recovery difficult, especially because modifications occur iteratively and automatically.
- Content
Static analysis
No suspicious patterns detected.