Security audit

EZ Math Model

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed math-modeling workflow, but bundled PaperOrchestra components add broad agent-history scanning, global skill installation, and plaintext credential persistence that go beyond the main purpose.

Review before installing. The core math-modeling workflow is reasonable, but avoid running external/paper-orchestra/setup.sh unless you intentionally want its nested skills globally installed and are comfortable storing keys in plaintext. Keep corpus and PaperOrchestra aggregation pointed at narrow project folders, skip home-directory or agent-cache scanning unless you explicitly need it, and prefer the EZMM setup flow with corpus, webcrawl, dataset, and inherited skills disabled unless required.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (67)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill advertises itself as a math-modeling workflow, but the described behavior extends into broad system modification, cache/log scanning, external repository fetching, and generic academic-research automation. This mismatch weakens informed consent: a user invoking a contest-modeling skill may not expect local agent data discovery, home-directory scanning, global symlinks, or broad network retrieval, which increases the risk of privacy exposure and unsafe side effects.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script interactively collects API keys and an executable path, stores them in the repository .env, and then duplicates them into a global plaintext config file. That behavior is unrelated to the stated ez-math-model purpose and increases credential exposure across the system, especially when installed into multiple agent environments.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script performs broad local and global installation into multiple agent skill directories, effectively modifying discovery paths for several unrelated AI agents. In the context of a math-modeling skill, this is over-scoped behavior that expands trust boundaries and can propagate unintended or unreviewed capabilities system-wide.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file advertises and implements an agent-log aggregation pipeline even though the enclosing skill metadata says the skill is for mathematical modeling. This scope mismatch is dangerous because it can cause an agent selected for harmless modeling work to instead access unrelated local artifacts and perform sensitive log discovery without the user's informed expectation.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill instructs scanning cwd and the user's home directory by default for agent cache and log files, which can expose sensitive prompts, credentials, personal data, and project history far beyond what is needed for math modeling. Even though the skill says it is read-only, broad filesystem discovery and LLM-assisted extraction materially increase the risk of privacy leakage and unintended data exfiltration.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script’s stated purpose is mathematical modeling support, but it is designed to discover AI-agent logs and caches across local and home directories. That creates an unnecessary data-discovery capability that can expose unrelated private project metadata and broaden collection far beyond user expectations.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Enumerating global directories such as ~/.claude and ~/.cursor/User/globalStorage allows the skill to map and surface files from unrelated activity across the user’s home environment. Even without reading file contents here, the generated manifest leaks sensitive path, project, and activity metadata that is unrelated to the declared skill purpose.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The general file patterns sweep notebooks, configs, logs, and READMEs across arbitrary search roots, which can inventory sensitive or irrelevant project artifacts. This broad discovery increases the chance of collecting proprietary metadata or facilitating later exfiltration by downstream phases.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The prompt explicitly instructs the agent to avoid stating limitations and frames this as a way to improve reviewer outcomes rather than to preserve factual neutrality. That creates a systematic incentive to produce reviewer-facing content that withholds material weaknesses, which can mislead evaluators and distort downstream decision-making even without fabricating raw data.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This content gives the skill an explicit capability to optimize manuscript text against reviewer behavior and automated acceptance signals, which is outside the stated mathematical-modeling purpose of the skill. In context, that misalignment increases the risk that the agent is repurposed for persuasive manipulation of evaluation processes rather than legitimate technical writing support.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This file defines a full literature-discovery and citation-verification pipeline, including parallel web search and Semantic Scholar lookups, which is outside the declared math-modeling scope of the parent skill. Scope-incongruent capabilities can expand data exfiltration and tool-use surface area, causing the agent to perform unnecessary external network activity and potentially bypass user expectations or policy boundaries.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documented procedure explicitly instructs the agent to use external web search and an optional Exa backend to gather candidates, introducing outbound network behavior not justified by the math-modeling skill description. In an overprivileged agent environment, such hidden or mis-scoped tool instructions can trigger unneeded external requests, leak task context to third parties, and increase exposure to prompt-injection or malicious search-result content.

Context-Inappropriate Capability

High

Confidence: 90% confidence
Finding: The script sends user-supplied queries and authentication material to a third-party service, which creates data egress outside the host environment. In the context of a skill advertised as mathematical modeling, bundling an unrelated literature-review search backend increases the risk of unexpected external transmission and may cause operators to disclose prompts, research topics, or workflow metadata to Exa without informed consent.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements literature-review candidate discovery behavior that does not match the stated purpose of the ez-math-model skill. Capability mismatch is dangerous because users and reviewers may grant trust or permissions based on the manifest while the package contains unrelated network-enabled functionality.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill instructs the host to invoke an aggregation skill over a user-mentioned directory to recover missing inputs, which expands scope from paper orchestration into broad file discovery and agent-history mining. That can expose unrelated local notes, transcripts, or sensitive project data not necessary for the immediate task, especially when triggered automatically before failing on missing inputs.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script exposes a feature flag that can inject a hard-coded 'Prismor Immunity Agent' security architecture diagram into generated papers, even though the skill is for mathematical-modeling deliverables. This is a supply-chain/content-integrity issue: a user or downstream automation could unknowingly produce papers containing unrelated or misleading content, harming trust, submissions, or decision-making.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: When enabled, the markdown parser can auto-insert the unrelated architecture diagram either on a marker or automatically before section 4, causing output to diverge from source content and user intent. In a paper-writing skill, silent insertion of unrelated material is dangerous because it creates unauthorized document modification and could contaminate academic or client-facing deliverables with deceptive content.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script’s header claims it is purely read-only and does not write anything, but the -Out branch can create directories and write a JSON file. This is a real integrity/trust issue because operators may rely on the docstring when deciding whether the script is safe to run in constrained environments, leading to unexpected filesystem modification.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs writing persistent state to `external/tools/setup_state.json` and later to user-level configuration such as `~/.ezmm.env`, but it does not present a prominent user-facing warning at the point of modification. Persistent config writes can alter future behavior, store sensitive preferences or tokens, and create surprising system state that survives the current task.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill invites scanning `external/user-corpus/` and generating an `AGENTS.md` summary without a clear privacy warning about potentially sensitive local documents. Even when user-provided, corpus contents may contain proprietary research, unpublished papers, notes, or personal data that should not be automatically indexed or summarized without explicit notice and scope limits.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README suggests broad natural-language trigger phrases such as aggregating agent logs or turning a folder into a paper. In hosts that auto-discover or auto-invoke skills from descriptions/examples, these phrases can match ordinary user requests and activate a workflow that scans local content well beyond what the user may have intended.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The quickstart includes prompts like writing a paper from work in an arbitrary directory, which are broad enough to overlap with common project-assistance requests. In an agent ecosystem, that creates a realistic risk of unintended invocation followed by large-scale file discovery and summarization.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README describes scanning agent caches and arbitrary directories, including chat histories and logs, without a prominent warning that these locations may contain secrets, personal data, proprietary prompts, or unrelated project material. That omission increases the chance that users or host agents treat broad scanning as routine and exfiltrate sensitive context into generated outputs.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Sensitive API keys are copied from .env into ~/.paperorchestra/config in plaintext without a clear warning that credentials are being duplicated into a second location. This increases the attack surface for credential disclosure through local file reads, backups, or accidental sharing.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are overly broad and can auto-activate the skill based on generic mentions of folders, directories, or paper-writing workflows. This increases the chance that a user conversation unrelated to log aggregation will invoke directory scanning and log extraction behavior unexpectedly, amplifying the impact of the skill's sensitive filesystem access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.