Security audit

c刊期刊分析

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for CNKI journal analysis, but its report script can write generated files outside the intended output folder if a crafted journal title is supplied.

Install only if you are comfortable with the agent browsing CNKI, using browser tooling, creating local JSON/chart/DOCX files, and installing Python dependencies. Run it in a dedicated project folder or virtual environment, and avoid processing JSON from untrusted sources until the journal-title output path is sanitized.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze_journal.py:463
Finding: Untrusted Journal Title Enables Output Path Traversal
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:135
Finding: Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes an end-to-end CNKI-powered journal analysis skill: user provides a journal name, the skill automatically retrieves the last five years of article metadata from CNKI, then produces a comprehensive report. The supplied code does only the downstream analysis and report generation portion. It expects a local JSON file already populated with journal_info and articles, and contains no network access, no CNKI scraping/API usage, no journal-name lookup, and no logic ensuring the data covers the most recent five years. While many report elements align partially with the description (keyword trends, methods, authors, sections, Word report generation), the primary advertised capability—automatic CNKI retrieval based on a journal name—is missing. In addition, the 'research gaps/submission advice' output is merely a generic placeholder rather than the full-dimensional expert analysis described. Therefore this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs reading a local reference file (references/journal_codes.md) but declares no explicit tool scope or permissions boundary. In an agent environment, undeclared file-read capability weakens least-privilege controls and can enable broader-than-expected local file access if the runtime infers or grants filesystem tools implicitly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Overly broad trigger conditions can cause the skill to activate on ambiguous user requests, leading to unintended browsing, data collection, file generation, or dependency-related actions. In an agentic environment, accidental invocation increases the chance of unnecessary external access and execution of higher-risk workflow steps.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill tells the agent/user to run pip3 install for multiple packages, which modifies the execution environment beyond the core analysis task. Environment-changing instructions can introduce supply-chain risk, break reproducibility, or be abused to install unexpected packages if the instruction path is generalized or tampered with.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The manifest frames the skill as analyzing a specified C journal by querying CNKI for recent issues and article metadata. This line expands capability to search the broader web for individual article abstracts, which is a separate retrieval mode not clearly justified by the stated journal-level macro-analysis purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.