Arxiv Skill Learning

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:55 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent research-learning purpose, but it can automatically run an extractor-provided shell command and persist generated learning results with broad workspace authority.

Review this carefully before installing. It should only be used in a sandboxed workspace where generated skills and smoke-test commands can be inspected first, because a malicious paper-derived extraction result or compromised extractor could run local commands or persist unsafe generated artifacts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:140

Finding

Arbitrary Shell Command Execution Through Untrusted Smoke-Test Command

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 140-148
Vulnerability Type: OS command injection through child_process.exec
Risk Level: High

Vulnerable Code

javascript

if (extractionResult.smokeTestCommand) {
  try {
    console.error(`[ArXiv Skill Learning] Executing: ${extractionResult.smokeTestCommand}`);
    // Ensure we run in workspace root to resolve paths correctly
    const { stdout, stderr } = await execAsync(extractionResult.smokeTestCommand, { 
      encoding: 'utf8', 
      timeout: 60000, // Increased timeout to 60s
      cwd: WORKSPACE_ROOT 
    });

Technical Analysis

extractionResult.smokeTestCommand is produced by an external extractor after it processes remotely sourced paper content. The value is passed directly to execAsync, which is a promisified version of child_process.exec.

exec interprets its input through a system shell. Consequently, shell operators, command substitutions, redirections, pipelines, and additional commands embedded in smokeTestCommand will be executed. The code applies no executable allowlist, argument validation, shell-metacharacter rejection, path containment check, sandbox, or privilege restriction.

A compromised extractor, malicious dependency, or adversarial extraction result can therefore turn the smoke-test facility into an arbitrary command-execution primitive.

Attack Path

1. An attacker influences the paper-derived extraction input or compromises the sibling arxiv-skill-extractor component.
2. The extractor returns a valid-looking result containing a skillName and a malicious smokeTestCommand.
3. The learning workflow verifies only that extractionResult.skillName exists; it does not validate the command.
4. The command is supplied unchanged to execAsync.
5. The operating-system shell interprets and executes the attacker's command from WORKSPACE_ROOT.
6. The payload runs with the same opera ...[truncated 889 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept an arbitrary shell command from the extractor. Define smoke tests as structured data containing a fixed test-runner identifier and a validated array of arguments.
2. Replace child_process.exec with execFile or spawn, and explicitly set shell: false.
3. Allowlist permitted executables and test actions rather than attempting to sanitize arbitrary shell text.
4. Resolve and validate all referenced paths. Require them to remain inside the generated skill directory using canonical-path containment checks.
5. Reject shell metacharacters, redirections, command substitutions, unexpected environment assignments, and unsupported arguments as defense in depth.
6. Run generated tests in an isolated, low-privilege sandbox or container with a read-only workspace, a dedicated temporary directory, strict resource limits, and no access to credentials.
7. Disable network access during testing unless it is explicitly required and tightly restricted.
8. Apply output-size limits in addition to the existing execution timeout.
9. Treat the extractor and all paper-derived content as untrusted, and validate the entire extraction result against a strict schema before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is limited to orchestrating learning from arXiv papers, but the reported behavior includes executing arbitrary shell commands from an extractor and persisting state to disk without clearly declared permissions. In a pipeline that ingests external paper-derived content, this mismatch is dangerous because users are not warned that untrusted generated output may gain code-execution and persistence capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill executes extractionResult.smokeTestCommand via child_process.exec, even though that command originates from another component that derives artifacts from untrusted arXiv paper content. This creates a direct command-execution path where a malicious or compromised extractor, or adversarial paper-to-skill pipeline, can run arbitrary shell commands in the workspace with the agent's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description omits a clear warning that it may commit generated skills into the workspace, which can permanently introduce unreviewed or malicious artifacts. In this context, the omission is especially risky because the source material is external and the generated skills may themselves contain dangerous code or instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.