Security audit

paper-reader (XuRuitian version)

Security checks across malware telemetry and agentic risk

Overview

This paper-reading skill mostly matches its stated purpose, but users should review it because it can save analysis files locally and includes web-search instructions despite claiming no network use.

Install only if you are comfortable with local scripts reading uploaded papers and writing generated analysis files to disk. For private, unpublished, medical, financial, or proprietary papers, disable or forbid web search, verify where the Word report and latest_analysis.json are saved, and delete retained files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell execution, local file reads/writes, and environment-dependent behavior without declaring corresponding permissions or constraints. This creates a transparency and governance gap: the agent may access local resources and execute tooling in ways users and policy systems do not expect, increasing the chance of unsafe file handling or command misuse.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior exceeds the stated purpose by writing reports to the desktop, persisting JSON locally, handling additional file types, and invoking system utilities for legacy .doc parsing. This mismatch is dangerous because users may consent to paper analysis but not to local persistence, desktop modification, or execution of external converters, which broadens the attack surface and privacy risk.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The README claims the skill performs only read-only text extraction, but elsewhere documents that it automatically generates and saves a Word report to the user's desktop. This is a behavioral mismatch that can mislead users and reviewers about filesystem side effects, reducing informed consent and making unexpected local writes more likely.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The skill is presented as a paper-reading and analysis tool, but the README adds automatic document creation and writing to the desktop, which goes beyond a purely analytical/read-only capability. This scope expansion increases risk because users may invoke the skill expecting analysis only, while the skill also performs persistent local side effects.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The workflow includes persisting analysis artifacts locally and writing a Word document to the user's desktop, even though the skill is presented primarily as a reading and analysis tool. Automatic local storage can expose sensitive paper contents, annotations, or derived insights to other local users, backups, indexing services, or sync tools without the user's awareness.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill mandates automatic desktop file generation as part of normal operation, which is broader than necessary for simply analyzing a paper. Requiring writes to a high-visibility user directory increases the chance of privacy leaks, accidental overwrites, and persistence of potentially confidential research content beyond the user's expectations.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The prompt explicitly instructs the skill to use Tavily to supplement analysis with external searches, which expands the skill from document analysis into open-ended web retrieval. This creates a scope expansion risk: the agent may fetch untrusted, irrelevant, or privacy-sensitive external content even when the user only asked to analyze an uploaded paper, increasing data exposure and tool misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The domain-specific search guidance introduces capabilities unrelated to the stated core function of reading and analyzing an uploaded academic document. In practice, this can cause the agent to blend user-provided content with uncontrolled web material, leading to hallucinated comparisons, provenance confusion, and unnecessary external data access.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The skill processes user-supplied academic files, and the .doc path delegates parsing to platform-native utilities such as textutil and antiword. Invoking external document converters on untrusted legacy office files increases attack surface because these binaries may have their own parsing vulnerabilities, potentially leading to code execution or sandbox escape in the host environment.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill instructs automatic generation and saving of a Word document to the desktop without a clear warning that user content will be written to local storage. This is dangerous because uploaded papers may contain confidential or unpublished material, and silent local persistence increases privacy exposure and data retention risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow explicitly writes analysis content to a JSON file and then exports it to a desktop Word document, but it does not warn about local persistence of potentially sensitive content. Temporary JSON files are especially risky because users may not realize they remain on disk and can be accessed later by other software, users, or sync mechanisms.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.