Security audit

nature-reader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paper-reading and translation helper, with minor cautions around lawful source use and optional file export.

Install only if you want Chinese bilingual paper analysis. Use lawful paper sources such as publisher pages, arXiv, institutional access, or Unpaywall, and confirm any export path before saving generated Markdown.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The description specifies a bilingual reader with Chinese translation, and the output template and guidelines consistently require Chinese output as the default behavior. This forces a specific language/locale without explicit user opt-in at activation time, which is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad enough to activate on many ordinary requests about reading or translating papers, which can cause the skill to take over interactions without sufficiently clear user intent. In a skill that may fetch remote content, read local PDF paths, and potentially export files, overbroad activation increases the chance of unintended tool use and unexpected data handling.

Ssd 2

Medium

Confidence: 95% confidence
Finding: Mentioning Sci-Hub as a fallback for paywalled papers provides acquisition guidance toward a well-known copyright-circumvention source, even if the skill says not to auto-fetch it. In context, this normalizes and facilitates bypass behavior during content retrieval, which is especially risky in a tool designed to help obtain and process academic papers.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The skill offers an export action that writes a Markdown file to a local path, but it does not clearly warn the user that a filesystem write will occur or require explicit confirmation at the moment of export. This can lead to unexpected local file creation and, in some environments, accidental overwriting or disclosure of derived content in predictable locations.

Static analysis

No suspicious patterns detected.