Nature Paper Hub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

This academic-writing skill is mostly coherent, but it needs review because it can send research topics to external services and includes unrelated personal-administration text in its local paper index.

Install only after reviewing the privacy implications. Use project-scoped installation where possible, avoid sending unpublished or confidential research topics to external services unless you explicitly approve the exact query and destination, audit or remove the contaminated paper-index record, and install dependencies in a dedicated environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

python-pptx== pandas== matplotlib== seaborn== openpyxl== ``` 2. Generate a fully resolved lock file that also pins transitive dependencies. 3. Record SHA-256 hashes for all permitted artifacts and install with: ```bash pip install --require-hashes -r requirements.lock ``` 4. Install dependencies in a dedicated, unprivileged virtual environment rather than the system Python environment. 5. Configure an approved package index explicitly and disable fallback to untrusted or unexpected indexes. 6. Add automated dependency scanning and update review to the release process. Review version changes before regenerating hashes. 7. Document that dependency installation must not be performed with `sudo` or an administrator account. ]]>

other

Warning

• Location: SKILL.md:464

Finding

Potential Disclosure of Confidential Research Queries to a Personal External Service

Content

View full analysis

(requires authentication — owner use only) Always query Tier 1 first; use Tier 2 only when owner is running the session. Example call: `web_fetch("https://ybliterature.com/api/search?q=electrocatalysis+oxygen+evolution")` ### RAG-enhanced writing (use when drafting any section): Before drafting Introduction, Results, or Discussion: 1. Query LitReview for the paper topic: ``` web_fetch("https://ybliterature.com/api/search?q=") ``` ``` `skills/nature-citation/SKILL.md:27`: ```text 2. **First: search personal LitReview library** — `web_fetch("https://ybliterature.com/api/search?q=")` - If results found: use these as primary citations (already in user's library) ``` ### Technical Analysis The skills instruct the agent to transmit user-provided research topics and scientific claims to `ybliterature.com`, described by the project itself as a personal LitReview service. Research queries may reveal unpublished hypotheses, manuscript topics, experimental directions, or commercially sensitive terminology. The data is transmitted as a URL query parameter. Query strings can be retained by the destination service, reverse proxies, monitoring systems, browser or tool histories, and access logs. The citation sub-skill directs the agent to use this personal service first without requiring informed user consent or confirming that the current session belongs to the service owner. The top-level skill contains an owner-only restriction, but that restriction is applied inconsistently: the RAG workflow still directs the agent to query the service when drafting sections, and the citation sub-skill does no ...[truncated 1658 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad end-to-end academic writing assistant, but the supplied code only performs one narrow function: generating publication-style figures from input datasets. It reads CSV/XLSX/JSON data, infers column types, chooses or accepts a plot type, renders charts, and saves image files. There is no code for literature search/review, writing manuscripts, verifying citations, auditing submissions, drafting cover letters, or handling reviewer responses. Figure generation is one subset of the declared scope, but the overall description materially overstates the skill’s capabilities and primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad end-to-end academic writing assistant covering many research-writing and submission tasks. The supplied code does not implement those capabilities. Instead, it only formats already-provided manuscript content from JSON into a Word document styled for Nature Portfolio journals. It performs no journal recommendation, no literature analysis, no drafting intelligence, no figure creation, no citation checking, no audit logic, no cover letter generation, and no reviewer-response support. While document export could be a supporting component of a writing pipeline, the actual code chunk is materially narrower than the declared full-pipeline assistant, so the description does not accurately represent the behavior shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad academic writing assistant focused on preparing and submitting Nature-series journal manuscripts. The supplied code does not implement those capabilities. Instead, it is narrowly focused on exporting a scientific presentation deck from structured JSON input using python-pptx. It formats slides, adds titles, body text, slide numbers, and figure placeholders, and saves a PPTX file. This is a materially different primary purpose from manuscript-writing assistance, with undeclared file-generation behavior and unrelated output format.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 450)May include surrounding context.

md

The repo includes `data/papers-index.json`: 534 curated papers (titles, journals, years, abstracts, DOIs)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

An immigration application/passport instruction block is unrelated to literature metadata and likely contains personal administrative content. Its presence indicates severe dataset contamination and creates a meaningful privacy risk if the skill retrieves, summarizes, or reproduces this text to users.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Installing the skill into '~/.claude/agents' makes it persist across sessions and projects, which expands the blast radius if the skill is later found unsafe or behaves unexpectedly. In this context, the skill handles sensitive research materials, so persistent global availability increases the chance of accidental invocation and repeated exposure of confidential content.

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

md

git clone https://github.com/Yang1Bai/nature-paper-hub.git

# 安装为用户级 subagents（全局可用）
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

md

# 安装为用户级 subagents（全局可用）
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md
cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 301)May include surrounding context.

md

# 安装为用户级 subagents（全局可用）
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md
cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 79)May include surrounding context.

md

# 安装为用户级 subagents（全局可用）
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md
cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md
cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 302)May include surrounding context.

md

# 安装为用户级 subagents（全局可用）
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md
cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md
cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

mkdir -p ~/.claude/agents cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 303)May include surrounding context.

mkdir -p ~/.claude/agents cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 304)May include surrounding context.

cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md cp nature-paper-hub/skills/nature-paper2ppt/SKILL.md ~/.claude/agents/nature-paper2ppt.md cp nature-paper-hub/SKILL.md ~/.claude/agents/nature-paper-hub.md

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

md

git clone https://github.com/Yang1Bai/nature-paper-hub.git

# 创建 skills 目录（默认不存在）并安装
mkdir -p ~/.codex/skills
for d in nature-paper-hub/skills/nature-*; do
  cp -R "$d" ~/.codex/skills/
done

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 325)May include surrounding context.

md

git clone https://github.com/Yang1Bai/nature-paper-hub.git

# 创建 skills 目录（默认不存在）并安装
mkdir -p ~/.codex/skills
for d in nature-paper-hub/skills/nature-*; do
  cp -R "$d" ~/.codex/skills/
done

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 108)May include surrounding context.

done

验证安装

ls ~/.codex/skills/

重启 Codex 后生效

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 331)May include surrounding context.

done

验证安装

ls ~/.codex/skills/

重启 Codex 后生效

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly promotes searching a personal literature library, performing web/CrossRef lookups, and exporting outputs, but does not warn that unpublished manuscripts, reviewer comments, PDFs, and citation libraries may contain confidential or sensitive research data. In an academic-writing skill, users are likely to provide pre-publication content, making silent transmission to external services or broad export behavior a real privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This is the English duplicate of the user-level persistent installation guidance. Global persistence is not inherently malicious, but for a skill that may process unpublished manuscripts and personal libraries, broad session persistence materially increases accidental exposure risk.

Content

Scanner excerpt · README.md (reported line 300)May include surrounding context.

md

git clone https://github.com/Yang1Bai/nature-paper-hub.git

# Install as user-level subagents (available in all projects)
mkdir -p ~/.claude/agents
cp nature-paper-hub/skills/nature-figure/SKILL.md ~/.claude/agents/nature-figure.md
cp nature-paper-hub/skills/nature-reader/SKILL.md ~/.claude/agents/nature-reader.md
cp nature-paper-hub/skills/nature-citation/SKILL.md ~/.claude/agents/nature-citation.md

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documented trigger phrases are very broad ordinary-language terms such as 'literature', 'abstract', 'export', and 'rebuttal'. In a conversational environment, overly generic activation keywords can cause unintended skill invocation on unrelated discussion, leading to accidental processing of sensitive manuscript content or external lookups without the user's clear intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill directs the agent to read local files such as journal specs, LaTeX templates, and a local paper index, but it does not declare any explicit tool scope or allowed-tools boundary. Undeclared file access increases the risk of overbroad local data exposure because users and reviewers cannot tell what filesystem capabilities the skill expects or may exercise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says to trigger when the user wants to write, revise, or submit a Nature-series paper, or needs help with any part of the academic writing process. That final clause is much broader than the skill's Nature-series scope and can overlap with many ordinary writing-assistance requests, making invocation boundaries unclear.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file states that interaction may be in Chinese or English, but all manuscript output is in English. This imposes a language constraint by default rather than offering a user choice or documenting a justified mandatory locale policy.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The bulk reference formatting workflow sends DOI-derived or user-supplied reference data to CrossRef without any stated consent or minimization controls. Even if bibliographic data is often public, pasted reference lists may reflect unpublished manuscripts, private reading lists, or sensitive research directions, resulting in unintended external disclosure.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

md

### 📋 Bulk Reference Formatting (quick mode)
If user pastes a list of references in any format (Google Scholar export, DOI list, messy copy-paste):
1. Parse each entry — extract authors, year, title, journal, volume, pages, DOI
2. For any missing fields, look up via CrossRef: `web_fetch("https://api.crossref.org/works/<DOI>")`
3. Re-format ALL entries into Nature numbered style in one batch
4. Also output a `.bib` BibTeX block for the entire list
5. Flag any entries that could not be verified

Static analysis

No suspicious patterns detected.