Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paper-reading and translation helper, with minor cautions around lawful source use and optional file export.
Install only if you want Chinese bilingual paper analysis. Use lawful paper sources such as publisher pages, arXiv, institutional access, or Unpaywall, and confirm any export path before saving generated Markdown.
The description specifies a bilingual reader with Chinese translation, and the output template and guidelines consistently require Chinese output as the default behavior. This forces a specific language/locale without explicit user opt-in at activation time, which is a natural-language policy concern.
The trigger conditions are broad enough to activate on many ordinary requests about reading or translating papers, which can cause the skill to take over interactions without sufficiently clear user intent. In a skill that may fetch remote content, read local PDF paths, and potentially export files, overbroad activation increases the chance of unintended tool use and unexpected data handling.
Mentioning Sci-Hub as a fallback for paywalled papers provides acquisition guidance toward a well-known copyright-circumvention source, even if the skill says not to auto-fetch it. In context, this normalizes and facilitates bypass behavior during content retrieval, which is especially risky in a tool designed to help obtain and process academic papers.
The skill offers an export action that writes a Markdown file to a local path, but it does not clearly warn the user that a filesystem write will occur or require explicit confirmation at the moment of export. This can lead to unexpected local file creation and, in some environments, accidental overwriting or disclosure of derived content in predictable locations.
