Academic Survey Self Improve

• Outcome: Review
• Latest audit: May 28, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

This survey-generation skill is mostly coherent, but it needs review because it automatically compiles user or arXiv-derived LaTeX locally and can overwrite user documents without strong safeguards.

Install only if you are comfortable with a tool that contacts arXiv, writes local TeX/PDF files, and runs pdflatex on generated or supplied documents. Use a constrained output directory, keep backups before using improvement commands, avoid unattended hourly scheduling unless you intend ongoing file creation and network traffic, and manually verify citations and academic claims before relying on the generated surveys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _compile_pdf(self, tex_file):
        try:
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_file)],
                    cwd=str(tex_file.parent),
                    capture_output=True,

• Confidence: 90% confidence
• Finding: The code executes a local LaTeX compiler on a generated .tex file that incorporates untrusted external content from arXiv paper titles, abstracts, authors, and categories without LaTeX escaping or sandboxing. Even though subprocess.run is invoked without shell=True, pdflatex itself interprets the document, so crafted TeX content can trigger file reads, resource exhaustion, or command execution depending on the TeX configuration and enabled features.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _compile_pdf(self, tex_file):
        try:
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_file)],
                    cwd=str(tex_file.parent),
                    capture_output=True,

• Confidence: 94% confidence
• Finding: The code compiles generated LaTeX via a local pdflatex subprocess using content derived from external arXiv metadata such as titles, summaries, and author names, without any escaping or sandboxing. This creates a realistic injection path into the TeX engine, which can read local files or execute commands depending on TeX configuration, turning untrusted remote content into local code-like input.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _compile_pdf(self, tex_file):
        try:
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_file)],
                    cwd=str(tex_file.parent),
                    capture_output=True,

• Confidence: 88% confidence
• Finding: The code invokes an external binary (`pdflatex`) on a LaTeX file that includes unescaped user-controlled content from `topic`. Even though `subprocess.run` is used without a shell, LaTeX itself is a powerful interpreter and compiling attacker-influenced TeX can lead to command execution or file read/write risks depending on the TeX configuration and enabled features. In this skill context, academic survey generation does not inherently require trusting arbitrary TeX input, so the danger is increased by directly embedding user input into the document and compiling it automatically.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            tex_path = Path(tex_path)
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_path)],
                    cwd=str(tex_path.parent),
                    capture_output=True,

• Confidence: 87% confidence
• Finding: The code executes `pdflatex` on a user-supplied `.tex` document via `subprocess.run`, which can process attacker-controlled TeX content. TeX compilation has a long history of abuse cases including file reads, command execution depending on engine/configuration, and resource exhaustion, so invoking it on untrusted input materially expands the attack surface.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""编译 PDF"""
        try:
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_file)],
                    cwd=str(tex_file.parent),
                    stdout=subprocess.DEVNULL,

• Confidence: 88% confidence
• Finding: The code invokes a local LaTeX compiler on dynamically generated content assembled from external arXiv metadata such as titles and author names, with no escaping or sandboxing. This creates a realistic attack surface for TeX-based file read, command execution, or denial-of-service behaviors depending on the local TeX configuration, even though shell=True is not used.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _compile_pdf(self, tex_file):
        try:
            for _ in range(2):
                subprocess.run(
                    ['pdflatex', '-interaction=nonstopmode', str(tex_file)],
                    cwd=str(tex_file.parent),
                    capture_output=True,

• Confidence: 87% confidence
• Finding: The code executes an external LaTeX compiler on a .tex file assembled from remote arXiv metadata such as titles, summaries, and author names, but it does not escape LaTeX-special characters or sandbox the compiler. This creates a real injection surface into pdflatex and expands risk beyond pure text generation into command execution via a local toolchain, especially if dangerous TeX features or permissive compiler settings are present in the environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that imply file reads/writes, network access, and shell execution, but it does not declare permissions or clearly bound those actions. This is dangerous because users and hosting platforms cannot make an informed trust decision, especially when the documented workflow includes unattended execution, PDF compilation, and external API access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented behavior overstates and partially misrepresents what the skill does, including quality guarantees, automation guarantees, and the nature of evaluation/improvement logic. Misleading behavior descriptions are security-relevant because users may grant trust, automation, or broad execution rights under false assumptions about reliability, scope, and safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The skill invokes a local compiler subprocess as part of processing remote and user-influenced content, expanding its attack surface beyond simple text generation. In this context, academic survey generation does not inherently require privileged local process execution, and the subprocess becomes materially riskier because it compiles attacker-controllable TeX content.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill performs external process execution as part of normal operation, which expands the attack surface beyond simple text generation. In combination with attacker-influenced TeX content, this can turn a content-generation tool into a local command/file-processing primitive, making the capability more dangerous than the manifest suggests.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: This skill's stated purpose is document generation, but it escalates to executing a local compiler process without necessity controls, isolation, or trust checks. In context, that stronger capability materially increases risk because the compiler is fed content derived from remote data and writes files on the local system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes automated generation and maintenance of output/history files without warning users that it will create and modify local files. In an agent setting, silent filesystem changes can lead to unexpected disk usage, overwrites, accumulation of generated content, or leakage through saved artifacts.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation describes live arXiv queries and metadata retrieval but does not clearly disclose network usage or the fact that user-provided topics may be sent to an external service. This matters because users may assume local-only operation and inadvertently expose research interests or generate unexpected outbound traffic.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cron example encourages unattended hourly execution without cautioning about recurring network traffic, repeated file creation, LaTeX compilation, and cumulative resource consumption. In practice this can create operational risk, fill storage, and repeatedly contact external services without user awareness.

Missing User Warnings

Low

• Confidence: 74% confidence
• Finding: Executing pdflatex without explicit disclosure is not just a transparency concern here because the command processes untrusted remote content and can consume significant local resources or trigger dangerous TeX behavior. In the context of this skill, hidden local command execution makes the risk more serious than a generic warning omission.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill automatically executes a local compiler on generated content with no warning, consent, or review step. In this context, because the LaTeX includes untrusted remote text, removing human review increases the chance that malicious or malformed input reaches the compiler and triggers file disclosure, command execution, or denial-of-service behaviors.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill repeatedly overwrites the provided `.tex` file in place without backup, preview, or confirmation. In an agent setting, this can destroy user content, corrupt important documents, or silently inject changes that later get compiled or shared, making the behavior unsafe even if not traditionally exploitative.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Running `pdflatex` without a clear user warning or explicit consent is dangerous because it executes a complex external toolchain on attacker-controlled document content. In this skill's context, the danger is increased because the same workflow first mutates the document and then automatically compiles it, creating an end-to-end path from untrusted input to external processing.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill silently executes pdflatex as part of normal operation, so a user invoking survey generation may unknowingly trigger local code-like processing on untrusted document content. Lack of warning or confirmation increases the chance that this higher-risk action occurs in unsafe environments and reduces opportunities to apply safer defaults.

Static analysis

No suspicious patterns detected.