Security audit

Arxiv Skill Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent research-to-skill purpose, but it can persistently create or overwrite agent-loadable skills using untrusted paper metadata.

Review pending_skill_task.json and paper metadata before running this skill, and avoid installing or loading generated skills until their SKILL.md content has been checked for prompt-injection text. Use it only in a workspace where overwriting generated arXiv skill directories would not destroy important work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: index.js:15
Finding: Untrusted paper metadata is embedded into generated skill instructions
Content: View full analysis
// If title is too short or missing, append key for uniqueness let skillName = `arxiv-${titleSlug}`; if (titleSlug.length < 5) { skillName = `arxiv-learned-${keySlug}`; } const skillDir = path.join(WORKSPACE_ROOT, "skills", skillName); const scriptsDir = path.join(skillDir, "scripts"); ensureDir(scriptsDir); fs.writeFileSync(path.join(skillDir, "SKILL.md"), renderSkillMarkdown({ skillName, paper })); ``` ### Technical Analysis The paper title, categories, paper key, an ...[truncated 2134 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:103
Finding: Title-derived directory collisions can overwrite existing skills
Content: View full analysis
// If title is too short or missing, append key for uniqueness let skillName = `arxiv-${titleSlug}`; if (titleSlug.length < 5) { skillName = `arxiv-learned-${keySlug}`; } const skillDir = path.join(WORKSPACE_ROOT, "skills", skillName); const scriptsDir = path.join(skillDir, "scripts"); ensureDir(scriptsDir); fs.writeFileSync(path.join(skillDir, "SKILL.md"), renderSkillMarkdown({ skillName, paper })); fs.writeFileSync(path.join(scriptsDir, "run.js"), renderNodeRunner({ paper })); fs.writeFileSync(path.join(skillDir, "paper.json"), `${JSON.stringify(paper, null, 2)}\n`); ``` ### Technical Analysis For normalized titles of five or more characters, the output directory name contains only the first 40 characters of the sanitized title. The paper key is not included. Different papers can therefore resolve to the same directory when they: - Have identical titles. - Differ only in characters removed or normalized by `sanitizeSlug()`. - Share the same first 40 normalized characters. - Are intentionally assigned a title crafted to match an existing generated skill. The code calls `ensureDir()` and then uses `fs.writeFileSync()` without exclusive-create flags, identity verification, or collision detection. Existing `SKILL.md`, `scripts/run.js`, and `paper.json` files at the resolved path are consequently overwritten. ### Attack Path 1. An existing skill is stored under a predictable path such as `skills/arxiv-example-title`. 2. An attacker supplies paper metadata whose normalized title resolves to the same `skillName`. 3. `ex ...[truncated 1235 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: For markdown files, warnings should disclose behaviors that may affect user data, privacy, or system integrity. The automation section states that the skill automatically reads pending_skill_task.json and runs the extraction loop, but does not warn users about local file consumption or automated processing side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Natural-language policy issues include forcing a specific language or locale without user opt-in. In this file, the automation instructions include Chinese comments (自动读取..., 或直接指定...) embedded in otherwise English documentation, which can impose a language expectation on users without explanation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.