phd-research-companion

• Outcome: Review
• Latest audit: Oct 13, 2026 · 3:29 PM UTC
• Version: 1.0.3

Overview

This skill is a coherent research-workflow CLI that uses local files, academic APIs, and user-directed scripts in ways that are disclosed and aligned with its purpose.

Install if you are comfortable with a command-line research tool that writes into project directories, sends search terms/claims to academic APIs, and may execute certificate scripts you explicitly provide. Keep generated outputs in a project workspace and do not run certificate or packaging commands on untrusted code without reviewing it first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims an end-to-end research management tool with multiple active capabilities. However, this code chunk is only an initializer script. It creates a directory structure for theory/empirical tracks and writes documentation/dashboard files that reference other hypothetical commands (e.g., run.py search, template, ledger, check), but those capabilities are not present in the provided code. There is no network access, no API usage, no LaTeX compilation or template creation, no proof or certificate generation, and no actual auditing logic. The primary purpose of the code is materially narrower than the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a substantial research-companion system with many domain-specific capabilities. The supplied code chunk does not implement or expose those features; it simply chooses python3 or python and runs run.py score as a thin verification wrapper. Based on this chunk alone, the actual behavior is materially different from the declared primary purpose. While this may be a supporting script within a larger package, the code provided itself is not accurately represented by the broad research-management description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad research-management system spanning setup, tracking, novelty checking, proof support, revision management, and auditing. The supplied code only implements a narrow utility: generating experiment design YAML/Markdown files for empirical evaluation plans. It does not access external APIs, manage projects, track revisions, produce LaTeX, maintain proofs, check novelty, or audit submissions. While experiment design generation could be a small supporting piece of an empirical research workflow, the actual code’s primary purpose is far narrower and materially different from the declared full-lifecycle capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about end-user research workflow capabilities, but the provided code does not implement any of those research functions. Instead, it is a maintainer-facing build/export script for packaging the repository into a Coze-loadable artifact. Its primary purpose is deployment/package validation, not literature search, LaTeX generation, proof management, novelty checking, certificate generation, revision tracking, or submission auditing. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk is narrowly focused on LaTeX template generation. It parses CLI arguments, resolves a venue, fills a static LaTeX template, writes main.tex, creates a placeholder references.bib, and emits a markdown file with compile instructions. While this partially matches the declared LaTeX-skeleton aspect and supports theory/empirical tracks, it does not implement the broader advertised research-management lifecycle or any of the more substantive capabilities such as API-backed literature search, novelty/priority checks, proof ledgers, exact-arithmetic certificates, revision tracking, or pre-submission audits. Thus the description materially overstates the skill's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad, full-lifecycle research-management system with multiple substantial capabilities: external literature search, LaTeX document scaffolding, proof ledgers, novelty checks, exact-arithmetic certificates, revision tracking, and submission auditing. The supplied code does only one narrow subset: it manages a local JSON-backed long-horizon research/proof session by saving attempts, checkpoints, and next actions, and showing status/resume information. While this loosely overlaps with 'proof ledgers' or project tracking, the primary purpose and capability set are materially narrower than declared. There are no external integrations, no document generation, no audit or novelty logic, and no theory/empirical track handling. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad end-to-end research management system for PhD projects. The supplied code chunk is much narrower: it is a literature search utility with real API calls and output formatting. While literature search is one part of the declared functionality, the code does not implement the other major advertised capabilities such as project setup/tracking, proof management, novelty auditing, revision tracking, submission auditing, or the described track modes. The network access to academic APIs is consistent with the literature-search subset, but the primary purpose of the code chunk is materially narrower than the declared full-lifecycle skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an end-user research companion for managing and auditing CS PhD research workflows. The actual code chunk does something materially different: it packages the skill for publication and validates repository/package hygiene. Its primary purpose is build/release tooling, not research assistance. While validation/audit language appears in both, the code’s audit scope is package publication requirements (frontmatter, required files, compile/help checks, archive size, checksums), not research content or workflow. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code’s actual function is narrow and specific: it processes local PDF files using PDF parsing libraries, extracts text, performs simple heuristic analysis of section keywords and theorem/math indicators, and outputs analysis reports. This is only a small literature-analysis utility. It does not implement the broad, declared full-lifecycle research management system, nor the claimed capabilities such as API-based literature search, project setup/tracking, LaTeX skeleton creation, proof-first/experiment-first workflow management, novelty checks, certificates, or revision auditing. The primary purpose is therefore materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a comprehensive research-management system spanning many phases of a CS PhD workflow. The actual code chunk is narrowly focused on one subfeature: maintaining a dependency DAG of formal claims for theory work. It reads/writes a local claims.json file, updates claim statuses, prevents marking a claim as proven when dependencies are unproven or missing, detects cycles, and emits a Markdown report. This aligns partially with the 'proof ledgers' part of the description, but does not implement the broader declared capabilities such as API-backed literature search, LaTeX skeleton creation, novelty/priority checks, exact-arithmetic certificates, revision tracking, or empirical-track support. Thus the declared description materially overstates the behavior of the provided code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad research-management system covering many stages of a CS PhD workflow. The supplied code chunk implements only one specialized subcomponent: exact rational-arithmetic certificate checking and reporting. While this does align with the 'exact-arithmetic certificates' portion of the description, it does not represent the broader declared primary purpose, nor does the code show literature search, LaTeX handling, project tracking, novelty checks, revision tracking, or track selection features. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code is narrowly focused on revision tracking and audit reporting for paper improvement rounds. It stores revision history in JSON, verifies evidence files by existence/size/SHA-256, generates a markdown report, and summarizes progress against a minimum-round submission gate. While revision tracking and audit are mentioned in the declared description, the description presents a much broader primary purpose: full-lifecycle research management with literature search, LaTeX support, proof ledgers, novelty checks, exact-arithmetic certificates, and theory/empirical modes. None of those broader capabilities appear in this code chunk. Therefore the description does not accurately represent what this specific code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement research-project setup, literature search, LaTeX skeleton generation, novelty checking, proof management for students, or submission audit of research artifacts. Its primary purpose is materially different: validating whether a separate quality scorer is falsifiable and resistant to vacuous high scores. While some filenames referenced in mutations resemble research-management components, this script itself only manipulates files, injects defects, runs the scorer, and emits an audit report. Therefore the declared description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description claims a broad full-lifecycle research management tool with setup, tracking, novelty checking, literature search over external APIs, LaTeX support, and dual theory/empirical tracks. The code chunk only performs a narrow pre-submission self-audit over existing local artifacts: claims.json, priority-records.json, revision-history.json, and certificate files. It generates a publishability report and prints blockers/warnings. While this partially aligns with the 'pre-submission audit' portion of the description, it does not substantiate most of the declared capabilities, making the declared description materially broader than the actual behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement research-project management features for end users. It does not perform literature search, generate LaTeX skeletons, manage proof ledgers, check priority/novelty, create arithmetic certificates for research results, track revisions of a project, or run a submission audit of a research artifact. Instead, its primary purpose is internal meta-evaluation of the skill package itself by probing code quality and test robustness. This is a materially different primary purpose and includes undeclared capabilities related to repository inspection and report generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a broad research-management system for CS PhD work, including search over real APIs, tracking, novelty checks, proof ledgers, certificates, revision management, and theory/empirical workflows. The supplied code does none of that. It only parses provided LaTeX files locally, extracts math regions and commands, compares used commands to standard or locally defined ones, reports possible undefined notation, counts theorem/proof environments, and flags unreferenced labels. While this could be a small supporting part of a pre-submission audit, the actual code chunk is far narrower and materially different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

Needs `pypdf` (see `requirements.txt`); `PyPDF2` and `pymupdf` also work.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

md

Needs `pypdf` (see `requirements.txt`); `PyPDF2` and `pymupdf` also work.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the generated Coze package includes a 'Chinese description and tags', which is a locale-specific requirement embedded in the skill documentation. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified for the target context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documentation describes capabilities that imply file read/write, network access, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an avoidable trust and containment gap: a host may grant broader capabilities than users expect, and the skill performs actions against local files, external APIs, and command execution contexts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run.py (reported line 112)May include surrounding context.

python

# "02-methodology-dev", ...). Pinning cwd to the install directory made
    # every default output land INSIDE the skill folder. Let the caller's cwd
    # decide where relative outputs go; scripts are invoked by absolute path.
    proc = subprocess.run([sys.executable, str(target), *argv[1:]])
    return proc.returncode

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring and generated frontmatter explicitly state that the description is rewritten in Chinese because the store audience is Chinese, and the inserted description text is only in Chinese. This is a natural-language locale policy concern because the file hardcodes a specific language choice without offering the user or publisher any language/locale option.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/multi_source_search.py (reported line 222)May include surrounding context.

python

filters.append(f"from_publication_date:{year_from}-01-01")
    if year_to:
        filters.append(f"to_publication_date:{year_to}-12-31")
    url = ("https://api.openalex.org/works?search=" + urllib.parse.quote(query)
           + f"&per-page={max(1, min(limit, 200))}"
           + ("&filter=" + ",".join(filters) if filters else ""))
    raw = _fetch(url, expect="json")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/multi_source_search.py (reported line 255)May include surrounding context.

python

def search_semanticscholar(query: str, limit: int, year_from: int | None, year_to: int | None) -> list[dict]:
    fields = "title,authors,year,venue,externalIds,abstract,url"
    url = ("https://api.semanticscholar.org/graph/v1/paper/search?query="
           + urllib.parse.quote(query)
           + f"&limit={max(1, min(limit, 100))}&fields={fields}")
    if year_from or year_to:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The script executes every discovered Python entrypoint with --help during packaging, which means arbitrary code in those scripts will run in the packager's environment. In Python, argument parsing is often preceded by top-level imports or initialization, so a malicious or compromised skill file can execute code, access local files, or perform network actions just by being packaged.

Content

Scanner excerpt · scripts/package_skill.py (reported line 120)May include surrounding context.

python

if rel.name in ("self_score.py", "score_selftest.py", "package_skill.py"):
                    continue
                try:
                    r = subprocess.run([sys.executable, str(src), "--help"],
                                       capture_output=True, text=True, timeout=30,
                                       cwd=str(SKILL_ROOT))
                    if r.returncode != 0:

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/priority_check.py:36

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_skill.py:33