Security audit

XY PubMed PDF Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its downloader can write outside the chosen download folder and overwrite existing PDF files if given a crafted filename.

Review before installing. Use only trusted identifiers and simple filenames without slashes or `..`, run it in a dedicated folder or virtual environment, and avoid letting untrusted text choose `--filename` or `--output` values. The publisher should constrain filenames to basenames, prevent accidental overwrites, and pin dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_pmc_pdf.py:115
Finding: Unrestricted Output Filename Allows Path Traversal and Arbitrary PDF File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:80
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Maintain dependencies in a lockfile or requirements file with cryptographic hashes: ```bash pip install --require-hashes -r requirements.txt ``` 3. Pin and review transitive dependencies as well as the direct dependency. 4. Install dependencies inside a dedicated virtual environment rather than a shared or system Python environment. 5. Use an explicitly trusted package index and avoid untrusted mirrors: ```bash python3 -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt ``` 6. Add automated dependency vulnerability scanning and a controlled update process so pinned packages can receive reviewed security updates. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares network and file-read capable behavior in its documentation but does not explicitly constrain tool permissions or allowed tools. In agent environments, missing scope declarations can lead to over-broad execution privileges, making unintended network access or local file access more likely if the runtime grants defaults.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown mixes an English header with the substantive usage instructions in Chinese, which effectively forces one language for users without opt-in. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a user language choice or document a justified regional limitation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.