T09 · Insecure Skill Coding Practices
Warning
- Location
generator.py:119- Finding
Plaintext arXiv Metadata Retrieval Enables Generated Markdown Content Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
HF Daily Papers (OFR Edition)
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently fetches public paper metadata and generates Chinese OFR paper reports, with disclosed optional Telegram sending and no evidence of hidden persistence, credential theft, destructive behavior, or agent hijacking.
Install only if you want a Chinese OFR-focused paper digest that contacts Hugging Face and arXiv. Configure TELEGRAM_TARGET deliberately before using run_and_send.sh or any cron job, because it can post generated report content to that Telegram target without an interactive confirmation. Review generated Markdown links if report integrity matters, since arXiv metadata is fetched over HTTP and titles are not escaped before rendering.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill's natural-language instructions and operational guidance are presented entirely in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module description and all user-facing output strings indicate the skill is tailored to Chinese-language reporting ('OFR 定制版', '科研日报', Chinese status messages) with no option for users to select another language. This is a natural-language locale constraint that is not presented as opt-in or justified as a region-specific compliance requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script automatically transmits generated content to an external Telegram recipient specified by environment variable, with no interactive confirmation, disclosure at send time, or restriction on destination. Even though the message content is derived from local markdown rather than obvious secrets, this creates an exfiltration/channel-abuse risk because the skill can send data off-host to any configured target.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The header comment describes the script as automatically generating a PDF recommendation report. In reality, the script defaults to fetching Hugging Face papers, extracting metadata, sorting it, and printing a Markdown output path; PDF generation only occurs conditionally when the --pdf flag is supplied and is delegated to another script.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script reads HF_DAILY_PAPERS_PROXY and sets HTTP_PROXY/HTTPS_PROXY automatically, affecting how external requests are routed. There is no user-facing notice that proxy settings may be applied to network traffic, which is relevant to privacy and system behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The function fetches data from huggingface.co over the network, which transmits system-originated requests externally. Although there are progress print statements, they only describe fetching activity and do not clearly warn users that the skill contacts third-party services and may disclose network metadata such as IP/proxy usage.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inline comment
# PDF (optional)and the--pdfflag handling imply that invoking this option will produce a PDF output. However, the implementation merely importsFPDFand then states that PDF generation is not implemented, which directly contradicts the advertised behavior of that code path.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This plain-text recommendation file uses Chinese headings and labels throughout, such as the title and section names, which can impose a specific language on users. Under the policy criteria, forcing a language without user opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script includes natural-language comments and console output in Chinese, such as the description on L03 and status message on L19, but provides no indication that the skill is intentionally region-specific or that users may choose another language. That creates a language/locale policy concern under the rule for forced language without opt-in.
- Content
Static analysis
No suspicious patterns detected.